> Most of the exposed datasets are a compilation of information from stealer malware, credential-stuffing sets, and repackaged leaks
it's from malware that is installed on users' machines, stealing passwords as they are being typed/submitted
