Security attacks on password managers have soared

A hand laying out a password
(Image credit: Getty Images / Boris Zhitkov)

  • Picus Security says the number of attacks against password managers skyrocketed in 2024
  • The malware is growing more sophisticated
  • Users should deploy MFA with password managers, research suggests

Cybercriminals are increasingly targeting password managers in an attempt to break into various important digital accounts.

Picus Security detailed its findings in the newly-released Red Report 2025, based on an in-depth analysis of more than a million malware variants collected last year, finding a quarter of all malware (25%) targeted credentials in password stores. This, the researchers claim, represents a three-fold increase compared to the year before.

“For the first time ever, stealing credentials from password stores is in the top 10 techniques listed in the MITRE ATT&CK Framework,” they said. “The report reveals that these top 10 techniques accounted for 93% of all malicious actions in 2024.”

Multi-factor authentication

The attackers are using all sorts of sophisticated extraction methods in their attacks, Picus Security co-founder and VP of Picus Labs, Dr. Suleyman Ozarslan said, including memory scraping, registry harvesting, and compromising local and cloud-based password stores.

To tackle the threat, Ozarslan added, it is pivotal people use password managers together with multi-factor authentication (MFA). Furthermore, they should never reuse a password, especially for their password manager.

The attacks are not just growing in volume, but in sophistication, as well. Picus said it’s seen threat actors prioritizing “complex, prolonged, multi-stage attacks” that require a new generation of malware. That malware, infostealers included, comes with increased stealth, persistence, and even automation. The researchers likened this increasing sophistication to “the perfect heist”, since most malware samples come with “more than a dozen malicious actions designed to help attackers evade defenses, increase permissions and exfiltrate data.”

A password manager is a tool that securely stores, generates, and autofills passwords for websites and apps. It helps users create and manage strong, unique passwords without needing to remember them all. It is considered one of the key pillars of good cybersecurity hygiene.

You might also like

TOPICS

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

You must confirm your public display name before commenting

Please logout and then login again, you will then be prompted to enter your display name.

Read more
Cartoon Phishing
Over a billion credentials stolen were stolen in malware attacks in 2024
Young woman working at a coffee shop with a laptop
Too many passwords, not enough brain space? Here’s how password managers can improve your life
Best email services: image of email with one unread message alert
Over 400 million unwanted and malicious emails were received by businesses in 2024
Keeper
Let 2025 be the year you upgrade your password security— get 50% off Keeper’s Personal & Family plans
password manager
I'm a security expert - here are my biggest tips for creating a secure password for work and home life to stay safe online
Hands typing on a keyboard surrounded by security icons
Infostealers on the rise: the latest concern for organizational defenses
Latest in Security
Data leak
Top home hardware firm data leak could see millions of customers affected
Representational image depecting cybersecurity protection
Third-party security issues could be the biggest threat facing your business
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Broadcom warns of worrying security flaws affecting VMware tools
Android Logo
Devious new Android malware uses a Microsoft tool to avoid being spotted
URL phishing
HaveIBeenPwned owner suffers phishing attack that stole his Mailchimp mailing list
Ransomware
Cl0p resurgence drives ransomware attacks to new highs in 2025
Latest in News
An image of Pro-Ject's Flatten it closed and opened
Pro-Ject’s new vinyl flattener will fix any warped LPs you inadvertently buy on Record Store Day
EA Sports F1 25 promotional image featuring drivers Oscar Piastri, Carlos Sainz and Oliver Bearman.
F1 25 has been officially announced, with this year's entry marking a return for Braking Point and a 'significant overhaul' for My Team mode
Garmin clippd integration
Garmin's golf watches just got a big software integration upgrade to help you improve your game
Robert Downey Jr reveals himself as Doctor Doom to a delighted crowd at San Diego Comic-Con 2024
Marvel is currently revealing the full cast for Avengers: Doomsday, and I think it's going to be a long-winded announcement
Samsung QN90F on yellow background
Samsung announces US prices for its 2025 mini-LED TV lineup, and it’s good and bad news
Nintendo Switch Lite
Forget the Nintendo Switch 2, the original Switch is getting one last hurrah in a surprise Nintendo Direct tomorrow