Cybercriminals exploit stolen credentials; LLMs help triage underground chatter, but human oversight remains critical.