Sponsored by

Whitepaper

The Economics of Account Takeovers in Social Media: A Tipping Point

Social media accounts make up 53% of account takeovers, according to Security.org, and they stay a target because the attacks pay. This white paper builds the attacker's profit and loss account for a credential stuffing campaign against social platforms, using prices gathered from dark web markets, Telegram and Discord. A list of a million stolen credentials yields around 150,000 working accounts at a typical 15% hit rate, each worth roughly ten cents in bulk, and how much of that inventory sells depends on the seller's reputation. Against five sites protected only by a CDN and web application firewall, Arkose Labs estimates the attacker spends about $624 a year and clears between $14,000 and $44,000. Add Arkose Titan to the same sites and the annual cost of the attack, driven largely by CAPTCHA-solving services, climbs to around $51,000, pushing the campaign into a loss. The paper walks through each assumption, the infrastructure attackers need at each level of defense, and the point at which an attack stops being worth running.