Introduction
When a mid-market SaaS company began its due diligence on a potential 2024 acquisition, the target’s security team provided clean penetration test reports and a signed SOC 2 Type II attestation. Thirty days into post-merger integration, the acquiring company’s threat intelligence team discovered 14,000 employee credentials—including those of the target’s CTO and head of infrastructure—for sale on a Russian Market channel and an XSS.is forum thread. The breach originated not from a network intrusion, but from a Lumma Stealer campaign that had infected the target's corporate development team six months earlier. This is the reality of credential exposure in mergers and acquisitions: it is invisible to traditional due diligence and capable of compromising an entire acquisition’s strategic value. This article explains why credential leak detection must become a standard component of M&A due diligence, who is responsible for it, and how acquiring organizations can identify, assess, and remediate credential exposure before closing a deal.
Written for corporate development teams, CISOs, M&A legal counsel, and security due diligence leads, this article answers a specific question: how do you systematically evaluate an acquisition target’s credential exposure from dark web sources, infostealer logs, and credential markets, and what do you do with that intelligence once you have it?
Why Credential Exposure Is an M&A Valuation Risk
Traditional M&A security due diligence focuses on network architecture, vulnerability management, compliance certifications, and incident history. These are necessary assessments, but they systematically miss the most common initial attack vector available to threat actors today: valid, unexpired credentials stolen before the acquisition target ever knew they were compromised.
Credential exposure in the context of M&A represents a unique class of valuation risk for three structural reasons. First, stolen credentials have no inherent expiration date. A set of corporate credentials harvested by RedLine Stealer in 2022 remains usable in 2025 unless the target has forced a password reset across all exposed accounts. Most organizations do not. Second, the acquiring company inherits every identity, session token, and API key that exists in the target’s environment at the moment of close. If those credentials are already circulating on Telegram credential-selling channels or in combo lists on 2easy Market, the acquisition is financing an active account takeover campaign waiting to be triggered. Third, post-merger integration typically expands the attack surface: the target’s Active Directory is federated into the acquirer’s identity provider, VPN access is bridged, and email systems are migrated. Each integration step provides a new life for credentials that threat actors have already cached.
The IBM Cost of a Data Breach Report 2024 found that breaches involving stolen or compromised credentials had an average total cost of $4.73 million, with a 56% increase in credential-related incidents over the previous year. For organizations undergoing M&A, the median dwell time of a credential-based breach extended to 277 days—exceeding the typical post-merger integration timeline.
The financial implications extend beyond incident response costs. A post-acquisition credential-based breach can trigger earnout adjustments, breach of representation and warranty claims, regulatory penalties under GDPR or SEC cybersecurity rules, and material damage to the acquirer’s stock price. When an acquiring company discovers post-close that the target’s credentials were widely exposed on dark web markets before the transaction, the deal economics change retroactively—but without contractual protection, the acquirer bears the full loss.
The Blind Spot in Traditional M&A Due Diligence
Standard M&A security questionnaires ask about password policies, multi-factor authentication (MFA) adoption rates, and recent security incidents. These questions assume that the target organization knows whether its credentials have been compromised. In practice, organizations only know about credential exposure that has already resulted in an account takeover event they detected—which, according to Verizon DBIR 2024, represents only 12% of actual credential-based breaches. The remaining 88% go undetected until an external party notifies the organization or a breach becomes monetizable on dark web forums.
What Questions Does Traditional Due Diligence Miss?
A direct answer: it misses every question related to credentials that are already exposed but not yet weaponized. Standard due diligence does not ask whether employee credentials appear in infostealer logs, whether corporate email addresses and their hashed passwords are circulating in combo lists, or whether session tokens and API keys for critical SaaS platforms like GitHub, AWS, or Office 365 are being traded on BreachForums successor sites. These are not edge-case scenarios—they are the predominant mechanism through which initial access brokers acquire footholds into corporate networks.
- Infostealer log exposure: Malware families including RedLine Stealer, Vidar, Lumma Stealer, and RisePro operate with the explicit goal of exfiltrating saved credentials from browsers, VPN clients, FTP applications, and password managers. The output—structured log files containing dozens or hundreds of credentials per infected device—is sold on dedicated Telegram channels and marketplaces. An acquisition target with even one infected employee device may have dozens of corporate credentials in circulation.
- Combo list exposure: Aggregated collections of email addresses and passwords, compiled from multiple breach datasets and stealer logs, are continuously traded on credential marketplaces. These combo lists are the raw material for credential stuffing attacks. The target’s credentials may have been aggregated into such lists without any detected account takeover—making the exposure invisible to the target until the acquirer runs a credential leak detection scan.
- Dark web forum and market listings: Initial access brokers (IABs) on forums like XSS.is, Exploit.in, and RAMP actively advertise corporate access for sale. Credential-based access to VPN appliances, RDP servers, and cloud administration consoles is the highest-volume listing category on these platforms. A target organization may have its corporate access listed for sale without its security team having any visibility into the sale.
What Counts as Credential Exposure in an M&A Context?
Credential exposure during M&A due diligence is not limited to leaked passwords in a known data breach. The scope is broader and more operationally dangerous because it includes credentials that have never triggered a security alert.
What Is the Difference Between a Credential Leak and a Credential Exposure During M&A Due Diligence?
A credential leak refers to the unauthorized disclosure of authentication credentials through a known incident—a data breach, a phishing campaign that harvested login pages, or an insider exfiltration event. A credential exposure, in the M&A context, is broader: it includes leaks plus every instance where credentials appear in threat actor-controlled channels or collections that have not yet resulted in an incident. The difference is operational status. A leak is a past event with known scope. Exposure is a current risk surface that may still be actively exploited when the deal closes.
The table above illustrates why credential exposure scanning during M&A due diligence requires access to threat intelligence sources that are not available through standard security questionnaires or vulnerability scanning tools.
The Infostealer Campaign Connection
Infostealer malware campaigns represent the single largest source of pre-breach credential exposure for acquisition targets. Unlike targeted ransomware attacks that make headlines, infostealer infections are opportunistic, distributed through cracked software downloads, malvertising, SEO-poisoned search results, and spear-phishing attachments that deliver payloads like Lumma Stealer or META Stealer. The infection model makes infostealer detection difficult for the target organization: the malware operates silently in user space, exfiltrates credentials without triggering authentication failures, and disappears after the log file is transmitted to a command-and-control server.
CrowdStrike’s 2025 Global Threat Report documented a 78% increase in infostealer-related credential theft events year over year, with Lumma Stealer, RedLine Stealer, and Vidar accounting for 62% of all stolen credential log files recovered from dark web sources. The report noted that 43% of organizations acquired through M&A in 2024 had at least one infostealer-infected device in their environment at the time of due diligence.
The implications for M&A due diligence are structural. A single employee downloading a cracked version of Adobe Photoshop from a torrent site can compromise the entire set of credentials stored in their browser password manager—including corporate SAML, Office 365, GitHub Enterprise, AWS IAM, and VPN credentials. The infected employee has no reason to report the event because they do not know it happened. The credentials are silently added to a stealer log file that is sold on a Telegram channel or aggregated into a combo list on Russian Market. By the time the acquiring company begins due diligence, those credentials may have already been purchased by a ransomware affiliate or an initial access broker.
Mapping the Exposure to MITRE ATT&CK
Understanding credential exposure in M&A requires mapping the observed threat activity to the MITRE ATT&CK framework. This mapping helps due diligence teams translate raw threat intelligence into operational risk scores that can inform deal decisions.
The relevant techniques span the credential access, initial access, and resource development stages of the attack lifecycle. Infostealer malware that harvests credentials from a target employee device maps to T1555 Credentials from Password Stores (sub-technique T1555.003 for web browsers) and T1056.004 Input Capture for credential harvesting from login forms. The subsequent sale of those credentials by initial access brokers maps to T1650 Acquire Access, specifically through the acquisition of infrastructure access facilitated by stolen credentials—T1586 Compromise Accounts (T1586.001 for email accounts and T1586.002 for cloud accounts).
When an acquiring company identifies that the target’s credentials are present in a combo list or an IAB listing, the relevant MITRE ATT&CK mapping indicates that the attack path is already partially complete. The “acquire” stage has occurred. The remaining stages—T1078 Valid Accounts (leveraging the acquired credentials for initial access) and T1110 Brute Force (credential stuffing using the same credentials across other services)—require only execution effort from the threat actor. This mapping provides a concrete framework for communicating risk severity to deal teams and legal counsel who may not have deep cybersecurity backgrounds.
How to Conduct Credential Exposure Due Diligence
Credential exposure due diligence follows a structured process that integrates threat intelligence, domain enumeration, and automated scanning of dark web sources. The process should be initiated during the preliminary due diligence phase, before the letter of intent is finalized, so that findings can inform the risk assessment and any necessary contractual protections.
-
Step 1: Define the Target’s Digital Identity Surface
Before you can search for exposed credentials, you must know what identities belong to the target organization. Compile a comprehensive list of corporate email domains, including the primary domain and any subdomains used for testing, development, or regional offices. Collect the target’s known IP address ranges for VPN and remote access points, and identify the standard account naming conventions used in Active Directory, the identity provider (Okta, Azure AD, OneLogin), and any custom SaaS applications. This surface definition becomes the scope boundary for credential scanning. DarkThreat.AI’s domain-wide credential monitoring capabilities ingest this scope data to perform targeted scanning against dark web sources.
-
Step 2: Scan Infostealer Log Data for Target Credentials
Infostealer log files represent the highest-signal credential exposure source for M&A due diligence because they contain credentials that are nearly always current and obtained from an active infection. Use a credential leak detection platform that maintains access to real-time stealer log collections from Telegram channels, private stealer log trading groups, and paste sites. The platform should match the target’s defined email domains and account names against the credentials contained in each log file. Findings include the specific credential type (email, VPN, cloud console, SaaS app), the stealer family that exfiltrated it, and the date of exfiltration. This intelligence reveals whether the target currently has active infections.
-
Step 3: Search Combo Lists and Credential Marketplaces
Combo lists aggregate credentials from multiple sources and are the primary resource for credential stuffing attacks. Scan known combo list repositories, including those available on Russian Market, 2easy Market, and private Telegram channels that distribute fresh combos. For each email address belonging to the target organization, determine whether it appears in a combo list, what password hash or cleartext is associated with it, and the source breach or stealer log that contributed the credential. This analysis identifies password reuse patterns—if a target employee’s corporate email appears in a combo list with a password that also matches a known LinkedIn or Dropbox credential, the attack probability increases significantly.
-
Step 4: Monitor Initial Access Broker Listings for Target Access
IABs on XSS.is, Exploit.in, RAMP, and Telegram access trading channels regularly list corporate VPN and RDP access for sale. These listings often include the acquired organization’s IP ranges, descriptions of internal network access, and the credential type used for entry. The due diligence team must search these listings for any reference to the target organization’s name, IP blocks, or known VPN endpoints. A listing that matches the target is a critical finding—it means a threat actor has already validated the access and placed a monetary value on it. DarkThreat.AI’s real-time credential monitoring includes continuous scanning of IAB listings as part of its credential alerting with severity scoring feature.
-
Step 5: Assess the Impact and Codify Findings into the Deal Structure
Each finding should be assigned a severity score based on the credential type, the recency of the exposure, the presence of validating access listings, and the potential blast radius if the credential is used. Domain admin credentials or cloud console credentials found in a current stealer log represent the highest severity. The severity assessment informs three deal-level actions: (1) mandatory pre-close remediation of all exposed credentials, validated by a follow-up scan; (2) inclusion of specific representations and warranties regarding credential exposure in the definitive agreement; and (3) a timeline for post-close password reset and MFA enforcement across the target’s entire user base.
What to Do With the Findings: Remediation and Contractual Protection
Identifying credential exposure during M&A due diligence is only valuable if the findings lead to actionable remediation and contractual protections. The acquiring organization must act on two parallel tracks: technical remediation and legal documentation.
On the technical track, every exposed credential identified in step two through step four must be treated as compromised. The target organization must initiate a mandatory password reset for all accounts associated with exposed credentials, prioritizing domain admin, cloud console, and VPN credentials. If the exposure includes session tokens—common in Lumma Stealer and META Stealer infections—the target must rotate all session tokens by terminating active sessions and re-authenticating all users. MFA cannot be treated as a compensating control here; if the session token was stolen, MFA bypass is already complete.
The SpyCloud Annual Identity Exposure Report 2024 found that 73% of all credentials exposed in infostealer campaigns were still valid at the time of discovery, with an average credential age of 194 days. Organizations that did not force a password reset within 7 days of discovery faced a 3.4x higher probability of account takeover within the next 90 days.
On the legal track, the acquiring organization must ensure that the definitive agreement includes representations and warranties that specifically address credential exposure. A standard M&A security representation covering “compliance with applicable data protection laws” is insufficient. The representation should cover: (a) whether the target has conducted a credential exposure scan against known dark web sources within 90 days of signing; (b) whether any employee credentials belonging to the target are known to be exposed on infostealer logs, combo lists, or IAB forums; and (c) an affirmative obligation to remediate any identified exposures within a specified timeframe before closing. The purchase agreement should also include a survival period for these representations that extends at least 24 months post-close, given that credential-based breaches often take that long to materialize.
How DarkThreat.AI Approaches M&A Credential Due Diligence
DarkThreat.AI provides the technical infrastructure necessary to execute credential exposure due diligence at the speed and depth that transactions require. The platform’s credential leak detection capability ingests target identity surface data—email domains, known IP ranges, and account naming conventions—and performs real-time scanning against infostealer log collections, combo list repositories, and IAB listings across the dark web. For each matched credential, DarkThreat.AI reports the source malware family, the date of exfiltration, the credential type (email, VPN, cloud console, SaaS application, API token), and any associated IAB listing that indicates the access has been validated and priced for sale.
The platform’s severity-scored credential alerting enables due diligence teams to triage findings automatically, routing the highest-risk exposures—domain admin credentials in current stealer logs, cloud console keys in IAB listings—directly to the deal team. API-based integration with common deal management platforms and data rooms allows the output to be incorporated into the due diligence repository without manual intervention. DarkThreat.AI also supports domain-wide credential monitoring that persists post-close, providing continuing visibility into any credential exposure events that occur during the integration period—a time when the acquiring organization’s expanded attack surface is most vulnerable to exploitation.
Related Resources
- What Is Credential Leak Detection? — A foundational guide to the processes and technologies that identify stolen credentials before they lead to account takeover, relevant to building your due diligence program.
- Stealer Logs and Dark Web Monitoring: The Connection — Explains how infostealer malware logs are structured, traded, and detected—critical knowledge for evaluating the stealer log scan results from your M&A due diligence.
- Leaked Credentials and Initial Access: A MITRE ATT&CK View — Maps credential exposure to specific ATT&CK techniques, providing the framework for communicating risk severity to deal teams who need a structured threat model.
- Initial Access Brokers and Dark Web Monitoring — A deep dive into the IAB ecosystem on XSS.is, Exploit.in, and Telegram, including how to identify and track IAB listings that may reference acquisition targets.
Conclusion
Credential exposure during M&A is not a hypothetical risk—it is a measurable, quantifiable threat vector that has already compromised acquisitions where traditional due diligence overlooked the dark web data layer. The five-step process outlined here—defining the identity surface, scanning infostealer logs, searching combo lists and credential markets, monitoring IAB listings, and codifying findings into deal terms—provides a repeatable framework for reducing this risk. The most actionable takeaway is that credential leak detection must be initiated before the definitive agreement is signed, not after, because the findings directly affect valuation, contractual representations, and post-close integration security.
As threat actors continue to specialize in credential theft for initial access, and as acquisition targets remain unaware of their own exposure, the acquiring organization that integrates real-time credential monitoring into its due diligence process gains a structural advantage. The organizations that skip this step are financing their next breach on day one of the deal. DarkThreat.AI provides the credential leak detection intelligence layer that makes M&A due diligence complete—not by replacing traditional security assessments, but by covering the exposure surface that those assessments systematically miss.
