Flare released new research showing a sharp rise in the number of stolen financial services (FinServ) credentials across North America. Between September 2025 and August 2026, 422,747 stealer logs containing FinServ and banking credentials were shared on underground forums, up 56.3% from 270,444 the year before. After peaking at 50,541 in March 2026, monthly volume has held at roughly 37,000 to 40,000 logs, about double the earlier baseline.
Most of these logs contain consumer logins for payment apps, bank accounts and investment platforms. However, the research found that a small share carries much greater risk. Flare identified about 2,000 infected machines holding operator access to systems that banks depend on, including card-issuing consoles, core banking vendors and payment rails. Card program platforms account for roughly half of them. Because these systems serve many institutions at once, a single stolen credential can expose every bank or FinServ running on that platform.
“The overall volume tells us the problem is growing, but the infected machines of bank staff and infrastructure operators are where compromised credentials can do the most damage,” said Estelle Ruellan, threat intelligence researcher at Flare. “One infected laptop with access to a card-issuing platform or a core banking vendor can put many institutions at risk at once. Those are the credentials security teams need to find first.”
Flare also found 2,644 logs that paired a financial platform login with a corporate email address from the same company, a strong sign the infected device belonged to an employee. At one major U.S. bank, nearly 40% of these employee-linked machines held credentials for internal staff systems, and fewer than 7% held only a personal banking login. When a single infected device holds both personal and work credentials, a routine infection on an employee’s computer can become an entry point into the bank itself.
Other Key Findings:
- The U.S. drove most of the increase. U.S. FinServ stealer logs rose 83.1% year over year, adding about 11,000 of the roughly 12,700 additional logs seen each month across North America.
- Canada’s volume grew 77.9%, while Mexico’s fell 4.8%, making Mexico the only country in the region to show a decline.
- Canada has the highest rate of employee-linked logs in North America, at about 1 in 100, roughly three times the rate in the U.S. and Mexico.
- Around 3,300 logs belonged to businesses using banking infrastructure platforms, including treasury systems that send ACH and wire payments, making them potential targets for wire fraud. This indicates a third risk tier between consumers and operators.
- Fintech and specialist platforms appear in 590,823 logs, or 85.2% of the sample, while traditional and established banks appear in 250,697 logs, or 36.2%. Investment, brokerage and wealth appear in 156,437 logs, or 22.6%.
Flare recommends that financial services organizations separate corporate exposure from customer exposure, prioritize banking infrastructure credentials for immediate triage, extend monitoring to vendor and subsidiary staff, and avoid relying on regional patterns alone when setting risk thresholds.
To learn more, read Flare’s report.
