Security attacks on password managers have soared

Number of attacks increases three times in just a year. When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works. Cybercriminals are increasingly targeting password managers in an attempt to break into various important digital accounts. Picus Security detailed its findings in the newly-released Red Report 2025, based on an in-depth analysis of more than a million malware variants collected last year, finding a quarter of all malware (25%) targeted credentials in password stores. This, the researchers claim, represents a three-fold increase compared to the year before.

“For the first time ever, stealing credentials from password stores is in the top 10 techniques listed in the MITRE ATT&CK Framework,” they said. “The report reveals that these top 10 techniques accounted for 93% of all malicious actions in 2024.”. The attackers are using all sorts of sophisticated extraction methods in their attacks, Picus Security co-founder and VP of Picus Labs, Dr. Suleyman Ozarslan said, including memory scraping, registry harvesting, and compromising local and cloud-based password stores.

To tackle the threat, Ozarslan added, it is pivotal people use password managers together with multi-factor authentication (MFA). Furthermore, they should never reuse a password, especially for their password manager. The attacks are not just growing in volume, but in sophistication, as well. Picus said it’s seen threat actors prioritizing “complex, prolonged, multi-stage attacks” that require a new generation of malware. That malware, infostealers included, comes with increased stealth, persistence, and even automation. The researchers likened this increasing sophistication to “the perfect heist”, since most malware samples come with “more than a dozen malicious actions designed to help attackers evade defenses, increase permissions and exfiltrate data.”.

A password manager is a tool that securely stores, generates, and autofills passwords for websites and apps. It helps users create and manage strong, unique passwords without needing to remember them all. It is considered one of the key pillars of good cybersecurity hygiene. Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!.

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications. Please logout and then login again, you will then be prompted to enter your display name.