How hackers steal business passwords and how to stop them

Ask most business owners how their passwords would get stolen and you get some version of the same answer: somebody guesses it, or somebody sniffs it off the coffee shop wifi. Both of those are real, both of them still happen, and neither is anywhere near the top of the list. The methods that actually take business credentials in volume are quieter, more industrialized, and in two cases specifically engineered to work on accounts that already have multi-factor authentication switched on.

That matters because the defensive advice most small businesses have been given is generic. Use strong passwords, turn on MFA, do not click suspicious links. It is not wrong, but it treats credential theft as one problem with one answer, and it is not one problem. There are six distinct routes, they have very different volumes, and the control that shuts one of them down completely does nothing at all about the next one. A business can do everything on the generic list and still be wide open on the route that is growing fastest.

This article walks each of the six routes in turn: how it actually works, roughly how common it is, and the specific control that stops it rather than the general advice that sounds like it should. Then it inverts the view and ranks the controls by how many routes each one closes, because that is the order you should buy and configure them in. It assumes a business of roughly 20 to 50 people on Microsoft 365 or Google Workspace, with or without a password manager.

If you think credentials have already been taken, this is the wrong article for today. Go to what to do if your business passwords are compromised and start with log preservation. And if what you want is the delivery routes for ransomware specifically rather than credential theft, how ransomware gets into small business networks covers that ground, including the parts that have nothing to do with passwords.

Short answer

Six routes account for essentially all business credential theft: phishing (including adversary-in-the-middle kits that capture the session after MFA succeeds), credential stuffing and password spraying using passwords leaked elsewhere, infostealer malware that empties the browser credential store and the cookie jar in seconds, social engineering aimed at your help desk and your account recovery process rather than at the password itself, brute force against exposed remote access and legacy authentication endpoints, and network interception, which is the one everybody worries about and the one that barely works anymore. Standard MFA fully stops two of the six, partially helps with two, and is routinely bypassed by the other two, which is the single most important thing on this page. The controls that close the most ground per unit of effort, in order, are phishing-resistant MFA or passkeys on the accounts that matter, a password manager that makes every password unique so a leak elsewhere stays there, blocking legacy and non-interactive authentication protocols, endpoint detection that catches infostealers, and a written verification step for identity and payment changes that does not depend on anyone recognizing a voice.

The six routes at a glance

Route	How common	What it takes	What actually stops it
Phishing and AiTM kits	Very high and rising	The password and the live session cookie	Phishing-resistant MFA or passkeys, token protection, filtering
Credential stuffing and spraying	Very high, fully automated	Any account reusing a leaked password	Unique passwords per account, MFA, lockout and IP controls
Infostealer malware	High and rising fast	Everything on the device, including cookies	EDR, no credentials in browsers, patched endpoints
Social engineering the process	Moderate, high value per hit	A password reset or an MFA re-enrollment	Out-of-band verification, help desk identity policy
Brute force on exposed access	High but noisy	Weak or reused passwords on open ports	Nothing exposed to the internet, legacy auth blocked
Network interception	Low, largely mitigated	Very little on modern HTTPS	HTTPS everywhere, corporate DNS, device certificates

Read that table one column at a time and a pattern shows up. Two of the six routes do not involve guessing your password at all, and two more do not care how strong it is. Password strength, the thing most policies are about, is decisive in exactly one row.

The MFA reality, stated plainly

This is the part worth being uncomfortable about, because almost every small business security conversation ends at “we have MFA” and treats the subject as closed.

Standard MFA, meaning a code or a push approval on top of a password, stops credential stuffing and it stops brute force. Those are the two highest-volume routes by raw attempt count, so this is a genuinely large win and nothing here argues against it. It also helps against basic phishing, where the attacker collects a password from a fake login page and tries to use it later.

It does not stop an adversary-in-the-middle phishing kit, because that kit does not want your password. It sits between you and the real login page, passes your MFA challenge through to the genuine service, lets you complete it correctly, and takes the resulting session cookie. The authentication succeeded. That is the point. It does not stop an infostealer either, for the same underlying reason: the malware takes the session cookie off the disk, and a cookie is proof that MFA already happened. It does not stop social engineering aimed at your help desk, because the attacker’s goal there is to have your own staff re-enroll MFA on a device the attacker controls. And there is a fourth gap that catches people badly: MFA can be bypassed entirely on authentication paths that never render a browser, which is what legacy and non-interactive protocols do.

So the honest scorecard is that MFA fully closes two routes, meaningfully reduces one, and is worked around by three. MFA is not enough makes the strategic version of this argument and MFA and passwords covers how the two layers divide the work. What follows is the mechanical version, route by route.

Route one: phishing, including the kind that walks through MFA

Phishing splits into two generations and they need different answers.

The old version harvests. You get a message, you land on a page that looks like the Microsoft 365 sign-in, you type your password, the page stores it and usually forwards you to the real site so nothing feels wrong. The attacker uses the password later. If you have MFA on, this generation mostly fails at the second step, which is why MFA adoption made a real dent in it.

The new version proxies. The attacker runs a reverse proxy between you and the genuine identity provider, so what you see is not a copy of the login page, it is the actual login page relayed through the attacker’s server. Every element is authentic because it is authentic. You type the password, it goes through. Your MFA challenge appears, because the real service issued it. You approve it, and it works. The service issues a session cookie to the successful login, and the proxy in the middle keeps a copy. The attacker imports that cookie and is inside the mailbox without ever needing the password or a second factor again.

This is not a niche technique anymore. Adversary-in-the-middle kits are sold as a subscription service on a monthly plan, with hosting and support, which means the skill required to run one is roughly the skill required to configure a website. Security researchers at Sekoia counted eleven distinct AiTM kits in active commercial operation in a single four-month window in 2025, with Tycoon 2FA the most prevalent. Microsoft reported blocking more than thirteen million malicious emails tied to Tycoon 2FA campaigns in October 2025 alone. Whatever the precise figure is by the time you read this, the direction is not ambiguous.

What stops it, in descending order of effectiveness:

Passkeys or hardware security keys. A passkey is bound cryptographically to the real domain. Presented with a proxy on a lookalike domain, it simply does not produce a credential, because there is nothing to relay. This is the only control in the entire article that defeats the attack outright rather than making it harder, and it is the reason passkeys are worth deploying on your highest-value accounts even while the rest of your stack still runs on passwords.

Conditional access with device compliance. A stolen cookie replayed from an unmanaged machine in another country fails a policy that requires a compliant, registered device. This turns a successful theft into a useless one. Conditional access in Microsoft 365 is where this is configured, and it is included in the licensing most small businesses already pay for.

Token protection and short session lifetimes. Binding tokens to a device where the platform supports it, and not leaving sessions valid for months, narrows the window a stolen cookie is worth anything in.

Email filtering and DNS filtering. These reduce how many of these messages arrive and how many of the destination domains resolve. They are volume controls rather than guarantees, and they belong in the stack for that reason. Phishing prevention covers the filtering layers in detail, and DNS filtering covers the destination side.

Training, with realistic expectations. The visual tells that training used to rely on are gone. Generative tools removed the spelling errors, the awkward phrasing, and the generic greeting, and they made personalized pretexts cheap. AI-powered phishing covers what the new signals are. Train people on process rather than appearance, because “this message looks professional” is no longer information.

Route two: credential stuffing and password spraying

These two are frequently lumped together and they are opposites.

Credential stuffing takes a known email and password pair from somebody else’s breach and tries it against your systems. It works entirely on reuse. The attacker is not guessing anything; they are checking whether the password your employee used on a hobby forum in 2019 is also the password on your accounting portal.

Password spraying inverts it. The attacker takes a small number of very likely passwords, the seasonal and company-name variants that appear in every corpus, and tries each one against a large list of usernames. Because each account only sees one or two attempts, nothing trips a lockout threshold designed to catch someone hammering a single account.

The volume here is difficult to overstate. Akamai has reported credential stuffing attempts in the region of 193 billion per year across its network. Verizon’s analysis of enterprise single sign-on logs put the median daily share of authentication attempts classified as credential stuffing at 19 percent, meaning roughly one in five login attempts against a typical business is this. Huntress reported credential spray volume against its customer base rising by a factor of more than 155 over six months, with a mean approaching two thousand failed spray attacks per tenant per month. None of this is targeted at you specifically. It is a background process the entire internet is subjected to continuously.

It works because reuse is close to universal. Reported password reuse rates land somewhere between 60 and 85 percent depending on the study, and around 73 percent of people use the same password for a personal account and a work account. Those numbers are the whole attack.

What stops it:

Unique passwords everywhere, which in practice means a password manager. This is the entire defence and it is complete. If no password is used twice, a leak from someone else’s breach cannot be reused against you, and the attack degrades into guessing. Nobody achieves uniqueness by willpower across ninety accounts, which is why a business password manager is the control rather than the policy that asks for uniqueness. If you have not picked one, how to choose and how to deploy it cover the selection and the rollout.

MFA, which turns a correct password into a failed login. Fully effective here, with the caveat about non-interactive paths in route five.

Knowing which of your credentials are already out there. This is the measurable version. A domain-wide breach search tells you which of your addresses appear in known dumps, and a vault tells you which passwords are reused internally. Running a password audit is the process for both, and it converts this route from a worry into a finite work list.

Lockout, throttling, and geographic or IP-based blocking at the identity provider. These raise the cost of the attempt. They do not fix reuse, and treating them as the answer leaves the underlying condition in place.

One nuance worth internalizing: a credential stuffing hit against a low-value system is not a low-value event, because the value is the password, not the system. Shared credentials make this considerably worse, since one leaked shared password is simultaneously a compromise of everyone who had it.

Route three: infostealer malware

This is the route that has changed the most, and it is the one small businesses are furthest behind on.

An infostealer is a small piece of malware with a narrow job. It runs once, harvests everything credential-shaped on the machine, sends it to the operator, and frequently deletes itself. It is not ransomware and it does not want to be noticed. What it takes, in the seconds it is running: the browser password store, session cookies for everything currently logged in, saved form data, cryptocurrency wallets, VPN and FTP client configurations, and any file that looks like it holds credentials, which very much includes the spreadsheet named passwords.

Scale reporting varies by vendor and methodology, but every source points the same way. One analysis attributed more than 1.8 billion stolen credentials in 2025 to infostealers across roughly 5.8 million infected devices. Another put the pool of compromised credentials, session cookies, and identity artifacts in circulation at well over two billion. macOS infections in particular went from a rounding error to tens of thousands of cases in a single year, which retires the assumption that this is a Windows-only concern.

The session cookies are the part that matters most for this article. A stolen cookie is an authentication that already completed, including the MFA step, which is exactly why an infostealer infection and an AiTM phishing hit end up in the same place by different roads. Article thirteen makes this point in the context of incident response, and it is the reason a password reset alone does not evict anybody.

Delivery is mostly mundane. Fake software downloads and cracked applications, malicious search advertisements above the genuine result, browser extensions, and increasingly instructions that persuade the user to paste a command into a terminal or a Run box themselves, which sidesteps a good deal of filtering because the user performs the action.

What stops it:

Endpoint detection and response, running and monitored. Traditional signature antivirus is the wrong tool for a class of malware that is repacked continuously. EDR watches behavior instead, and the monitoring half matters as much as the software half, because an alert nobody reads at ten at night is not a control. Managed detection and response is the version of this that includes someone reading it.

No business credentials in browsers. The browser store is the first thing taken and it is fully readable to malware running as the logged-in user, whatever encryption is nominally applied. Browser-saved passwords covers how the store actually works, how to disable saving by policy, and how to migrate what is already in there.

Restricting what users can install, and patching what they run. Standard user accounts rather than local administrators, application control where you can manage it, and current browsers and operating systems. Patching remote machines covers doing this for people who never come into the office, and setting a new laptop up properly covers starting from a good baseline.

Session revocation as a reflex. Since the prize is a cookie, revoking sessions has to be part of any response, and it is a separate action from resetting a password on every major platform.

Personal devices are in scope. A personal laptop with a synced browser profile that includes work credentials is an infostealer target that your controls do not cover. That is a policy question as much as a technical one.

Route four: social engineering the process, not the person at the keyboard

The previous three routes attack the credential. This one attacks the procedure that issues credentials, and it is the one that most often defeats a business that has done everything else properly.

The pattern is consistent. Somebody calls the help desk, or your office manager, claiming to be an employee locked out before an important meeting. They are friendly, they are in a hurry, they know the employee’s name and manager and job title because that is all on your website and LinkedIn, and they need a password reset or their MFA re-enrolled on a new phone. The person helping is being helpful. That is the vulnerability, and it is not a training failure so much as a process failure.

The reason this is worth a section of its own is that generative tools have removed the last informal check. A familiar voice on the phone used to be weak evidence but real evidence. Voice cloning needs seconds of reference audio, and any recorded webinar, conference talk, or voicemail greeting is enough. Voice cloning and deepfakes covers this specifically. Recognising the caller is no longer information, in exactly the way that a well-written email is no longer information.

Adjacent variants: SIM swapping, which redirects SMS codes to an attacker-controlled number and is the main reason SMS is the weakest surviving second factor; MFA fatigue, where repeated push prompts are sent at inconvenient hours until somebody taps approve to make it stop; and help desk impersonation aimed at the identity provider rather than at your business, where the target is your vendor’s support process instead of yours.

What stops it:

A written verification standard for identity actions, applied without exception. Password resets, MFA re-enrollment, changes to recovery email or phone, and changes to banking or payroll details all require verification through a channel that is not the one making the request. Call back on the number in the HR record, not the number on the request. Confirm through a manager. The rule has to be written down and it has to apply to executives, because the request that arrives with authority and urgency attached is the one it exists for. A password policy is where this lives.

Number matching instead of simple approve prompts, and authenticator apps or keys instead of SMS. Number matching kills MFA fatigue because there is nothing to approve blindly. Moving off SMS removes the SIM swap route.

Self-service password reset with real verification. This reduces the volume of legitimate reset requests, which is what makes it possible to treat the remaining ones with suspicion rather than as routine work.

Fewer people holding the keys. Every administrator is a target for this. Service accounts and standing privilege deserve the same scrutiny, and a departure that leaves credentials behind is the same weakness on a delay, which what happens to your passwords when an employee leaves covers.

Route five: brute force against exposed remote access and legacy authentication

Classic brute force, meaning try every combination against a login until one works, is largely a solved problem on modern services with throttling and lockout. Where it still succeeds is where something is exposed that should not be, or where authentication takes a path that skips the modern controls.

Exposed Remote Desktop is the long-running example. A server with RDP published to the internet is found within hours by continuous internet-wide scanning, and from there it is a matter of trying weak and reused passwords until one lands. It has been a primary ransomware entry route for years and it remains one because it keeps getting re-exposed by somebody who needed access on a Friday afternoon.

The version that catches otherwise well-run businesses is legacy and non-interactive authentication. Some protocols hand a username and password directly to a token endpoint without ever rendering a browser, which means no interactive MFA prompt is ever shown. A June 2026 campaign illustrated it precisely: more than 81 million login attempts over fourteen days, ending in 78 compromised Microsoft accounts across 64 organizations, using recycled breached credentials through the OAuth resource owner password credentials flow. Of the affected organizations, only eight had no MFA at all. The other 56 had MFA enabled with a configuration gap that left a non-interactive sign-in path unprotected. Those businesses would have told you, accurately, that they had MFA on.

What stops it:

Nothing management-related exposed directly to the internet. RDP, SSH, and management interfaces belong behind a VPN or a zero trust access broker. A business VPN is the traditional answer and zero trust network access is the more granular one. Either beats a published port.

Block legacy and non-interactive authentication explicitly. This is a conditional access and tenant configuration task, not a checkbox that comes on by default, and it is the specific gap in the campaign above. Microsoft 365 security hardening covers the tenant settings.

Know what you have published. Most businesses cannot say with confidence what is reachable from the internet, and the answer is usually one item longer than expected. A firewall that is actually configured rather than merely present is the enforcement point.

Alert on failed authentication volume. Spray campaigns are loud in the logs and invisible in daily life. Somebody has to be watching, which is the same argument as the EDR one, and signs your network has been compromised covers what else to look for.

Route six: network interception, and why it is last

Intercepting credentials in transit is the method with the highest ratio of public fear to actual incidents, and it has earned its place at the bottom of this list.

The mechanism is real. An attacker on the same network, or operating a wifi access point named something plausible, positions themselves between the user and the destination and reads the traffic. Fifteen years ago this reliably yielded passwords, because a great deal of the web was unencrypted.

That world is gone. More than 95 percent of web traffic is now encrypted, browsers actively warn on unencrypted pages, and HSTS preloading means major services will not accept a downgraded connection from a modern browser at all. A passive attacker on the same network as your employee sees encrypted traffic and destination names, not passwords. Trying to intercept properly requires presenting a certificate the device does not trust, which produces the warning screen everybody has been trained to fear.

What remains is narrower and worth naming honestly. Captive portal flows sometimes still start unencrypted, so credentials typed into a hotel wifi splash page deserve suspicion. DNS manipulation on a hostile network can redirect a user to a convincing clone of a site whose strict transport policy is not already cached. Certificate warnings clicked through defeat the whole model, which is why “never click past a certificate warning” is a genuinely load-bearing rule. And a compromised or malicious device on your own office network is a different and more serious problem than a coffee shop, because it is inside the perimeter and it is persistent.

What stops it: HTTPS everywhere, which you mostly get for free; devices configured to use corporate DNS; keeping guest wifi on a separate network from business devices; and treating a certificate warning as a stop rather than a speed bump. A VPN helps on hostile networks, though the honest framing is that its main value now is access control and traffic routing rather than the credential protection it is usually sold on. Business wifi versus consumer wifi covers the segmentation side.

Why this section exists at all: because a business that spends its security attention on public wifi is spending it on the sixth most likely route while the first three go unaddressed. Correcting the ranking is worth more than the specific advice in it.

The controls, ranked by how much they close

Same information, inverted. If you are deciding what to do next rather than what to worry about, work this list downward.

Control	Routes it closes or materially reduces	Effort
Passkeys or hardware keys on key accounts	Phishing including AiTM, stuffing, spraying, brute force	Moderate, per account
Password manager with enforced uniqueness	Stuffing, spraying, and the blast radius of everything else	Moderate, mostly rollout
Conditional access and device compliance	AiTM replay, stuffing, spraying, stolen cookie reuse	Moderate, mostly configuration
Block legacy and non-interactive auth	Spraying, brute force, the MFA-bypass path	Low, one-time, high risk if skipped
EDR with someone monitoring it	Infostealers, and everything post-compromise	Moderate, ongoing cost
Credentials out of browsers	Infostealers, personal-device leakage	Low, mostly policy plus a migration
Written out-of-band verification rule	Social engineering, help desk resets, payment fraud	Low, entirely process
Number matching, no SMS second factor	MFA fatigue, SIM swap	Low, one-time
Nothing exposed to the internet	Brute force, and a large share of ransomware entry	Varies, sometimes just an audit
Email and DNS filtering	Phishing volume	Low, usually already licensed

The top four are configuration and rollout rather than new spend for most businesses on Microsoft 365 Business Premium, which is worth checking before anyone quotes you for a product. If you can only do three things this quarter: uniqueness through a password manager, phishing-resistant authentication on email and finance and administrator accounts, and blocking legacy authentication. Those three touch every high-volume route on the list.

Common mistakes

1. Treating MFA as the finish line. It closes two of six routes completely and is designed around by the two that are growing fastest.
2. Assuming MFA is on everywhere because it is on somewhere. The gap is usually a non-interactive protocol or a service account, and it does not show up in the admin console summary.
3. Relying on SMS as the second factor. It is better than nothing and it is the weakest option still in common use, defeated by a SIM swap that requires no technical skill.
4. Rotating passwords on a schedule instead of enforcing uniqueness. Forced rotation produces predictable variants and NIST has recommended against it for years. Uniqueness is the property that matters.
5. Training people to spot phishing by how it looks. The visual tells are gone. Train on process and verification instead.
6. Believing an infostealer is an antivirus problem. It is repacked continuously, it runs once, and it deletes itself. Behaviour-based detection with monitoring is the control.
7. Leaving business credentials in browser profiles, particularly synced personal ones. That is the first store the malware empties and it is outside your visibility.
8. Having no written rule for password resets and MFA re-enrollments, so the decision is made in the moment by whoever picks up the phone under time pressure.
9. Publishing remote access to the internet because it was quicker, and never revisiting it. Internet-wide scanning finds it in hours, not weeks.
10. Spending the security budget on the sixth route. Public wifi interception is largely handled by HTTPS, and attention spent there is attention not spent on the first three.

How this fits the rest of your credential security

Every article in this series is a partial answer to something on this page. A password manager removes reuse, which is the entire mechanism behind route two. Passkeys are the only clean answer to route one. Getting credentials out of browsers removes the richest target in route three. A written policy is where the verification rule that blocks route four has to live to survive a busy Tuesday. Single sign-on shrinks the number of places a credential exists at all, which reduces the surface for every route simultaneously. An audit tells you which of these already happened to you. And what to do if your business passwords are compromised is the article you will want on the day one of them works.

The useful way to hold all of it: attackers are not trying to defeat your password. They are trying to arrive at a valid session by whatever route is cheapest this month, and the password is only one of the six doors into that room. Defences chosen with that in mind look noticeably different from defences chosen to make passwords harder to guess.

What is next in this series

The final article in this cluster takes the observation underneath all six routes, that a completed login is not the same thing as a trustworthy one, and turns it into an architecture. Zero trust and password management, covering what continuous verification actually means for a business without an enterprise security budget, and which parts of it are worth adopting when you already have MFA, a password manager, and conditional access in place.

How Sequentur can help

If you want an honest read on which of these six routes your business is actually exposed to, and the shortest path to closing the ones that matter, schedule a call.