Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstalliTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A “traffer” is a distribution participant in the infostealer ecosystem described in Outpost24’s 2026 Specops Breached Password Report: someone who helps get malware in front of victims, often by persuading them to run it. The term does not have a universally established definition or verified etymology, and the report does not show that traffer activity is rising across the entire cybercrime landscape.
What does “traffer” mean?
Outpost24 uses “traffer” for a role in the distribution of infostealer malware. In the report’s account, operations can depend on non-technical participants who reach potential victims and induce them to execute malware. This is a description of the term in that report, not a settled taxonomy that every criminal group uses in the same way.
The title’s “rise” should be read cautiously: the 2026 report highlights the importance of distribution to infostealer operations, but the cited evidence does not establish a measured increase in traffer activity over time. Nor does it establish where the word originated.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →How do traffers fit into credential theft?
Credential theft is often a chain of roles rather than the work of one malware author. Boundaries can overlap, but the roles below describe different things supplied to the next actor.
| Role | What the role supplies | How the material may be monetized or used next |
|---|---|---|
| Stealer operator | Infostealer malware or a malware-as-a-service operation designed to collect data from infected devices. | Collected data can be sold, shared, or passed into aggregation and resale channels. |
| Traffer or other distributor | Reach to victims and a route for getting malware executed; the report describes users being induced to run it. | Distribution helps an operation obtain infected devices and scale collection. |
| Aggregator | Combined credential records, which may be organized into username-login-password (ULP) datasets and may include login URLs. | Structured records can be packaged for sale or use by other criminals. |
| Credential broker or seller | Credentials or collections of account records. | Buyers may reuse logins for account abuse, fraud, or as a step toward broader access. |
| Initial access broker | A foothold in a system or network, sometimes advertised with network details. | A buyer, including a ransomware affiliate, may use the access as an entry point for a later intrusion. |
Europol’s IOCTA 2025 describes access credentials, compromised corporate networks, and personal logins being sold in bulk as part of an economy that supports fraud, ransomware, extortion, and identity theft. Microsoft’s analysis of access brokers describes a different commodity from a password record: access to a network. A stolen credential can contribute to an intrusion, but not every stolen credential is used for ransomware.
How do infostealers collect passwords?
An infostealer is malware designed to harvest credentials and other data from an infected device. Outpost24 describes distribution that can rely on a person being persuaded to run the malware. Once present, the malware can collect credentials and other browser or device data. The resulting information may circulate as raw stealer logs or be combined into ULP datasets: records organized around usernames, login information, and passwords, sometimes with the associated site’s login URL.
Rank #2
These are criminal data products, not necessarily a count of unique people or newly compromised accounts. Records can be duplicated, accumulated over time, or combined with information from other sources. The presence of a credential in a dataset does not by itself establish when it was stolen, whether it still works, or how it will be used.
What do the reported numbers show—and what do they not show?
Outpost24’s threat-intelligence team analyzed credentials attributed to infostealer malware during 2025 for its 2026 report. Its family-level figures describe that report’s attributed dataset, not a census of all credential theft worldwide.
| Malware family | Credentials attributed in Outpost24’s 2026 report | Scope |
|---|---|---|
| LummaC2 | 60,934,662 | Outpost24 attribution for its analysis during 2025. |
| RedLine | 31,144,858 | Outpost24 attribution for its analysis during 2025. |
| Vidar | 5,965,748 | Outpost24 attribution for its analysis during 2025. |
| StealC | 3,441,423 | Outpost24 attribution for its analysis during 2025. |
| Raccoon Stealer | 1,656,673 | Outpost24 attribution for its analysis during 2025. |
In the same report, LummaC2 accounted for nearly 60% of credentials attributed to infostealer malware in Outpost24’s 2025 dataset; RedLine accounted for just over 30%, while Vidar, Stealc, and Raccoon Stealer together accounted for less than 11%. Those shares apply to that attributed sample alone. They are not global market shares, and the report’s stated category spelling “Stealc” differs from the family label “StealC” used in its count.
Outpost24 also identified 5,899,505,920 credentials within ULP datasets in 2025. That is a count of credentials present in datasets identified that year—not passwords newly stolen during 2025. The report says those datasets accumulate information over time from stealer logs, historical breaches, and other methods. This accumulated ULP total and the family-level attribution counts have different scopes and should not be added together.
Where do stolen credentials go?
Raw logs and aggregated credential records can move through sellers and brokers to buyers seeking usable accounts. Europol’s 2025 overview places stolen personal logins and corporate access in a wider underground market supporting multiple types of crime. Depending on the account and the buyer’s objective, credentials may enable account takeover, fraud, identity theft, or a foothold for further intrusion.
Network access brokers sell something broader than a login pair. Microsoft describes brokers obtaining access—by scanning for vulnerable systems or through other means—and advertising network details. Ransomware affiliates may select and buy access according to its potential value, then use a compromised system as an entry point. Some transitions from broker access to affiliate activity can happen quickly, according to Microsoft, but that observation does not establish a typical timeline for all incidents.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How credential theft can feed a ransomware intrusion
Credential theft may be one stage in a human-operated ransomware incident, not the entire attack. Microsoft’s defensive guidance describes a possible pre-ransom sequence involving initial access, reconnaissance, lateral movement, and persistence. An attacker may use stolen credentials during that broader activity, but the source does not suggest that every infostealer infection leads to ransomware.
Timing matters for defenders: signs such as phishing, credential theft, suspicious sign-ins, or lateral movement can indicate a wider incident. If activity is identified before the ransom stage, isolating affected devices or accounts may help contain it. The right response depends on the incident’s stage and scope; changing a password alone should not be treated as proof that an active intrusion has been resolved.
Tycoon 2FA: a related identity threat, not a traffer case
Microsoft reported on 4 March 2026 that it worked with Europol and industry partners to disrupt Tycoon 2FA, a phishing service that captured credentials and authentication codes. A court order enabled the seizure of 330 active domains. Microsoft said the service had operated since at least 2023 and that operators used captured credentials and session tokens for account impersonation and follow-on activity. This illustrates the wider identity-attack ecosystem; the report does not identify Tycoon 2FA as a traffer operation.
Recommended Free Tools
Microsoft’s accompanying figures have distinct scopes: the company attributed approximately 62% of phishing attempts it had blocked by mid-2025 to Tycoon 2FA, reported more than 30 million emails in a single month, and estimated 96,000 distinct phishing victims worldwide since 2023. These numbers concern Tycoon 2FA, not traffers as a whole, and measure attempts, email volume, and estimated victims respectively.
Quick Recap
What readers and defenders should take away
- “Traffer” describes a distribution role in Outpost24’s 2026 report; it is not a universally standardized job title.
- Credential theft can involve separate operators, distributors, aggregators, credential sellers, and access brokers.
- Large totals can count accumulated records rather than fresh theft in a particular year. Always check what the number measures and whose dataset it describes.
- Stolen logins can be reused or resold for account abuse and may contribute to broader intrusions, but a credential leak alone does not prove ransomware activity.
- For incident response, investigate the surrounding activity and scope rather than assuming that a password change by itself ends an intrusion.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
