Loading story…
Recent research highlights the persistent risk posed by weak passwords, with modern password cracking tools able to compromise a significant portion of real-world credentials in under an hour. Analysis of over 190 million passwords reveals that nearly 60% can be cracked within sixty minutes, largely due to the power of contemporary GPUs and advanced brute-force and dictionary attack techniques. Security experts emphasize the importance of adopting stronger authentication strategies, such as using passphrases and password managers, to mitigate these risks and prevent unauthorized access to sensitive systems and data.
Longitudinal studies of leaked password datasets from 2007 to 2025 show that user habits and password strength have improved over time, particularly following major breach events and the introduction of stricter password policies. The adoption of machine-generated passwords and built-in password managers in operating systems has contributed to measurable progress, though a minority of users still rely on weak, easily guessed credentials. Security professionals recommend continued education and the implementation of advanced password management tools to address remaining gaps and further strengthen enterprise security posture.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
A subsequent report highlighted recent research indicating that almost 60% of real-world passwords can be cracked within an hour using modern password-cracking tools and hardware. The coverage emphasized the continued risks from short, predictable, reused passwords and recommended password managers, passphrases, and MFA.
On publication, Flare-backed research summarized two decades of leaked-password data and concluded that overall password security has improved, though weak-password use persists among some users. The study highlighted the positive impact of password managers and policy changes on password strength.
Bergeron's research identified a second major improvement period starting in 2019, when password quality increased further. This phase was associated with broader adoption of password managers, machine-generated passwords, and stricter standards.
Flare researcher Andréanne Bergeron's analysis of leaked passwords from 2007 to 2025 found a notable improvement in password strength beginning around 2011. The shift was linked to stronger password policies and changing user behavior following major breach events.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A recent analysis of over two billion leaked passwords revealed that easily guessable and weak passwords such as `123456`, `admin`, and `password` remain among the most commonly used worldwide. Variations like `Aa123456`, `Aa@123456`, and sequential keyboard patterns such as `qwerty` and `1q2w3e4r` also feature prominently in the top 100, highlighting persistent poor password hygiene among users. The study found that a quarter of the most common passwords consist solely of numbers, and 38% contain the string `123`, making them highly susceptible to brute-force and guessing attacks. Complementing these findings, research into the top 1,000 most-visited websites showed that 42% have no minimum password length requirements, and only five enforce strong password policies that include length, special characters, and case sensitivity. Additionally, 11% of these sites have no password creation requirements at all, and only 2% support passkeys as a secure alternative. The lack of robust password enforcement on major websites, especially in sectors like government and healthcare, perpetuates the use of weak passwords and increases the risk of account compromise.
Jun 29, 2026
A new report from password manager 1Password highlights that weak or compromised passwords remain a significant security risk for organizations, with employee password practices worsening despite increased awareness. Survey data from over 5,000 workers across multiple countries reveals that a majority of employees, including IT professionals, continue to reuse passwords, rely on default credentials, or share passwords via insecure channels, exacerbating the threat landscape for businesses. The report underscores that even as companies move toward passwordless authentication, the transition is gradual and current credential management practices are not keeping pace with evolving threats. In response to these challenges, technology vendors are accelerating the adoption of passwordless solutions. Microsoft has released Edge version 142.0, introducing cross-platform passkey synchronization, allowing users to securely reuse passkeys across devices and browsers. This feature, which requires a dedicated PIN for access, aims to enhance both security and usability, reducing reliance on traditional passwords. The move reflects a broader industry trend toward passkeys and multi-factor authentication as default options, with major platforms like Google and Meta also embracing passwordless technologies to mitigate the risks associated with password-based authentication.
Jun 29, 2026
Cybercriminals are increasingly targeting enterprise credentials through phishing, brute force attacks, and exploitation of password reuse, leading to widespread compromise and monetization of login details. Attackers use tactics such as convincing phishing emails, credential stuffing, and the sale of stolen credentials on underground markets, enabling further exploitation including data theft and ransomware. The prevalence of password reuse and weak password management practices among employees exacerbates the risk, as users often rotate between a small set of passwords or make only minor variations, making it easier for attackers to gain access to multiple accounts once a single credential is compromised. Security experts are urging organizations to move away from traditional password-based authentication and adopt phishing-resistant, device-bound cryptographic solutions such as FIDO2, passkeys, and certificate-based authentication. These measures are seen as essential to counter the growing threat posed by automated attacks leveraging AI agents and large-scale credential theft. SaaS providers are also encouraged to integrate with identity platforms that support these advanced authentication methods to strengthen overall security posture and reduce the risk of credential-based breaches.
Jul 12, 2026