Account Compromise Surged 389% in 2025, Says eSentire

eSentire's 2025 Year in Review reports a dramatic surge in credential compromise—accounting for 75% of observed malicious activity and a 389% YoY rise in account compromises—driven primarily by phishing-as-a-service (PhaaS) kits that enable MFA bypass and rapid business email compromise; malware (notably ClickFix-related delivery and CastleLoader) comprised about 25% of threats. The report highlights targeted sectors (software, finance, real estate, retail, construction), increased email-bombing/help-desk impersonation attacks, and the widespread availability and evolution of PhaaS operations as key risk drivers.