The new analysis suggests stolen credentials remain a major parallel threat.