Until phishing‑resistant, passwordless authentication becomes a mainstay, organizations will remain more vulnerable to credential‑theft‑driven attacks.

A cybersecurity firm has detected an increase in password-stealer detections in its South-east Asia customer base for 2025, compared to its 2024 metrics. Its products had detected and blocked more than one million password‑stealer incidents in corporate networks across the region in 2025, up about 18% from 2024.

Password stealers are a category of malware that harvest stored credentials from browsers, apps, and system caches, including website logins and sometimes cryptocurrency‑related data. In theory, such stolen credentials can be used for financial theft, identity abuse, extortion, or to pivot into other systems.

By country, the highest year‑on‑year increases in Kaspersky’s data were in the Philippines (41%), Malaysia (33%), Singapore (25%), Vietnam (21%), and Indonesia (7%), while the firm’s Thailand market recorded a 21% decline*. The values are not normalized by market size or number of protected endpoints, so the percentages may reflect changes in Kaspersky’s own customer‑coverage footprint rather than a view of the entire region’s threat landscape.

Kaspersky has also cited a separate 2026 survey of about 193m leaked passwords, in which an estimated 45% could be cracked within a minute using common brute‑force and dictionary techniques, while about 23% resisted cracking for more than a year. That study focused on password strength in general, not on the specific SEA‑based incidents counted in the password‑stealer telemetry.

According to the firm’s Managing Director (Asia Pacific), Adrian Hia, the most effective approach to eliminate password theft risks is by “adopting password managers that generate and securely store truly random credentials, alongside enforcing strong access policies such as multi-factor authentication, regular credential audits, and least-privilege access. Training employees and embedding cybersecurity-as-a-culture policies and behavior in companies is also paramount.”

Editor’s note: Even for organizations that have moved beyond passwords or adopted phishing‑resistant authentication, the real challenge lies ahead: anticipating how attackers will weaponize AI‑driven social‑engineering, deepfake‑based verification bypasses, and automated credential‑spray campaigns at scale. Some best practices can be found at the Identity Defined Security Alliance website.

*Cited as an outlier in the firm’s report, without any further details