Infostealer study finds law enforcement, all 8 Ivies breached

Researchers built a dataset from 170,298 infostealer victims, pulling credentials out of malware logs and anonymizing them for study. The paper says it's the first victim-level infostealer dataset released under controlled access rather than sold or dumped raw.

The breach list runs wider than gaming accounts and streaming logins, though those dominate by volume. Government, military, remote-access, and development platforms all show up. So do credentials tied to law enforcement domains and all eight Ivy League universities, meaning people with access to sensitive systems are getting hit by the same commodity malware as everyone else.

The overlap is what should worry security teams. Victims in this dataset show up again in phishing and ransomware populations, which suggests infostealer infections aren't a separate problem from those bigger attacks. They're often the entry point.

What the paper doesn't settle is how much of this reuse is old passwords sitting in old logs versus active credentials right now. Infostealer logs get resold and recirculated for months after the original infection, so a credential's presence in the dataset doesn't tell you it still works.

For anyone running security for an org with .edu or .gov-adjacent users, password reuse across personal and institutional accounts is the mechanism here, not sophisticated targeting. The fix is the boring one. Credential monitoring against known-compromised lists catches more than another phishing training module.