Austin, TX/USA, November 18th, 2025, CyberNewsWire
Forecast report highlights surge in identity-based threats, evolving threat actor tactics, and increased risk from AI and insider threats.
SpyCloud, the leader in identity threat protection, today released its report, The Identity Security Reckoning: 2025 Lessons, 2026 Predictions, outlining 10 of the top trends that will shape the cyber threat landscape in the coming year.
The predictions, based on observed and analyzed cybercrime activities from the past year and SpyCloud’s proprietary research and recaptured identity intelligence, shed light on the evolving tactics of cybercriminals and the identity-based threats security teams need to anticipate.
“Identity misuse is threaded throughout nearly every trend outlined in the report, from malware-driven session hijacking to synthetic identities and exposed non-human credentials,” said Damon Fleury, SpyCloud’s Chief Product Officer.
“As attackers exploit this expanding footprint, organizations will be forced to rethink how they detect, respond to, and prevent identity threats across their entire ecosystem.”
SpyCloud’s Top 10 Identity-Driven Threats That Will Shape 2026:
- The cybercriminal supply chain continues to transform: Malware-as-a-Service and Phishing-as-a-Service will remain core enablers of cybercrime, but 2026 will bring new “specialized roles” in the criminal economy that will make it easier for bad actors to operate at scale and with startup-like efficiency. These specialized roles include infrastructure providers, tool developers, access brokers, and even support services.
- Threat actor communities will fragment, evolve, and get younger: Law enforcement crackdowns and platform policy changes will continue pushing threat actors from darknet forums to mainstream apps. But perhaps more alarming is the influx of teen cybercriminals experimenting with plug-and-play attack kits for clout, profit, or curiosity. 2025 was also a big year for exposing Chinese cybercrime tactics, a trend expected to continue in 2026 alongside the rise of Latin America as a new hotbed for fraud and organized threat activity.
- The non-human identity (NHI) explosion will fuel hidden risks: Driven at least in part by the proliferation of AI tools and services, APIs, OAuth tokens, and service accounts, known as NHIs, are proliferating across cloud environments. These NHI’s often lack protections found more commonly in human-based credentials, like multi-factor authentication (MFA) and device fingerprinting. As these machine credentials quietly amass privileged access to critical systems, they create stealthy entry points for attackers and serious compliance gaps for enterprises.
- Insider threats will be fueled by M&A, malware, and missteps: In 2026, security teams will grapple with risks from compromised users, employment fraud from nation-state bad actors, and M&A activity that introduces inherited vulnerabilities and identity access sprawl. The “human element” will continue to be a weak point in proactive defense.
- AI-enabled cybercrime has only just gotten started: In 2026, AI will increasingly be used by bad actors to craft better malware, more believable phishing, and quickly triage vulnerable environments, increasing the overall risk to enterprises posed by this rapidly advancing technology
- Attackers will find creative ways around MFA: This year, SpyCloud found that 66% of malware infections bypassed endpoint protections. Expect to see more trending methods used to bypass MFA and other session defenses: residential proxies to spoof location authentication measures, anti-detect browsers to bypass device fingerprinting, Adversary-in-the-Middle (AitM) attacks used to phish credentials and steal valid cookies.
- Vendors and contractors will test enterprise defenses: Vendors and contractors continue to be a preferred attack vector to access enterprises. In 2026, organizations will need to treat third-party and contractor exposed identities with the same rigor as employee accounts – especially in tech, telecom, and software supply chains where threats are most acute and have a broader impact.
- Synthetic identities will get smarter and harder to spot: Criminals are assembling fake identities from real, stolen data and then enhancing them with AI-generated personas and deepfakes to defeat verification checks. With banks already flagging synthetic identity fraud as a top concern, expect this to become a front-page issue in 2026.
- Distractions like combolists and “megabreaches” will obscure real threats: Expect more viral headlines touting “billions of records leaked” even as many stem from recycled data found in combolists or infostealer logs – collections of already-exposed records repackaged by criminals to generate hype, fear, and clout. While older, unremediated data can still cause risk for organizations, these events often trigger widespread concern and divert attention away from more immediate, actionable threats.
- Cybersecurity teams will restructure to tackle new threat realities: As identity security becomes the common denominator across fraud, cyber, and risk workflows, teams will prioritize cross-functional collaboration, automation, and holistic identity intelligence to drive faster, more accurate decisions.
“With the speed that technology moves, cybercrime evolves in lockstep and it’s equal parts fascinating to watch and challenging to keep up with,” said Trevor Hilligoss, SpyCloud’s Head of Security Research.
“The commoditization and influence of the dark web will continue to complicate things, making 2026 another nonstop year for defenders. Understanding the TTPs of these cybercriminals and gaining insights into the data they find most valuable will help these defenders continue to stay one step ahead and positively impact these efforts in years to come. But you can be sure we’ll track these shifts in real time and enable our customers and partners to effectively combat identity misuse in all of its forms.”
To explore the full report and see how SpyCloud’s holistic identity threat protection solutions help security teams prevent identity-based attacks like ransomware, account takeover, and fraud, users can click here.
About SpyCloud
SpyCloud transforms recaptured darknet data to disrupt cybercrime.
Its automated identity threat protection solutions leverage advanced analytics and AI to proactively prevent ransomware and account takeover, detect insider threats, safeguard employee and consumer identities, and accelerate cybercrime investigations.
SpyCloud’s data from breaches, malware-infected devices, and successful phishes also powers many popular dark web monitoring and identity theft protection offerings.
Customers include seven of the Fortune 10, along with hundreds of global enterprises, mid-sized companies, and government agencies worldwide.
Headquartered in Austin, TX, SpyCloud is home to more than 200 cybersecurity experts whose mission is to protect businesses and consumers from the stolen identity data criminals are using to target them now.
To learn more and see insights on your company’s exposed data, users can visit spycloud.com.
Contact
Account Director
Emily Brown
REQ on behalf of SpyCloud
[email protected]