Account Market Intelligence
Every verified open-source observation, newest first. Each entry feeds the platform pages, the price index and the research registry automatically — verifying an observation recalculates that platform's score and price percentiles.
Submit evidenceSubmissions are reviewed before publication. Excerpts are sanitized: no seller identities, contact details, invite links, credentials or marketplace locations are stored or shown. Asking prices are not realized prices.
Researchers examining more than 64,000 unique cloud access keys exposed publicly between 2022 and 2026 found that around 88% of a retested sample still authenticated, and 768 granted full administrative control of a corporate cloud account.
View sourceA researcher found a publicly accessible database of roughly 149 million credential records, of which about 900,000 were Apple iCloud username and password pairs. The records were attributed to infostealer malware rather than a compromise of Apple infrastructure.
View sourceResearchers documented credential-stealing malware sold on a subscription basis since 2025 that harvests Discord account tokens, saved credentials, payment methods and session data to enable account takeover.
View sourceKaspersky Digital Footprint Intelligence identified more than 7 million compromised credentials tied to major streaming platforms during 2024, with Netflix accounting for the largest single share. The credentials were harvested by infostealer malware campaigns rather than a breach of the platform itself.
View sourceThreat-intelligence analysis attributes access to credentials harvested by infostealer malware and later circulated through underground credential trading.
View sourceReporting on the same disruption noted that the fraudulent Outlook accounts were sold through a dedicated service and that a well-known intrusion group was among the buyers, using the accounts to support further attacks.
View sourceA second outlet, citing the same threat-intelligence dataset, described stolen ChatGPT credentials being traded inside underground log markets under subscription-style access models, most commonly harvested by three named infostealer malware families.
View sourceMarket activity is an external indicator of abuse incentives, not a measurement of fraudulent accounts on the underlying platform. Prices are never inferred — an observation without a published figure is recorded without one. See the methodology for scoring and confidence rules.