Data breaches have long been the most visible measure of cybercrime. But while breach numbers appear to be trending down, a quieter and far more personal threat has been growing in the background, and that’s Infostealers, a type of malware that silently harvests everything stored on a victim's device.
“Data breaches going down might sound like progress, but it really means criminals have found a more efficient way in,” says Mantas Sabeckis, senior threat intelligence researcher at Nord Security. “A single infostealer infection can silently grab saved passwords, cookies, autofill data, and even session tokens. It’s less dramatic than a breach, but for the individual, the damage can be just as severe.”
New research from NordVPN, conducted in collaboration with NordStellar shows that the number of compromised databases dropped by 36% between 2024-2025, from 4,804 to 3,069. In the same period, infostealer logs jumped by 35%, from 19.5 million to more than 26 million.
Key takeaways:
· In 2025, compromised databases leaked nearly 34 million passwords. Infostealers harvested 624 million. That’s more than 18 times as many.
· For email addresses, breaches exposed 542 million while infostealers captured 380 million and the gap is closing in the past few years.
· Infostealers most commonly spread through pirated software, fake downloads, and phishing emails. Once installed, they run silently in the background. But using a password manager instead of saving credentials in the browser keeps software up to date.
