While the credentials often originate from Russian leaks (like the massive Mail.ru or VK breaches), they are used globally to hijack accounts on Western services.