Most intrusions we investigate began with a valid credential or a stolen session, not with an exploit. This module finds the credentials, cookies and tokens of your employees, customers and suppliers in the sources where they first circulate, verifies them and gets them revoked before anyone uses them.
Infostealer malware quietly copies saved passwords, browser cookies and session tokens from infected devices, including personal computers used to reach corporate systems. The logs are sold and shared within hours. Public aggregators see them much later, once they have passed through many hands and have often already been exploited.
Our analysts collect from the criminal supply chain directly, attribute each record to the right account and system, remove duplicates and stale data, and deliver a verified list with the evidence and the exact remediation needed. Where you authorise it, we confirm in a controlled way whether an exposure still grants access, so that your team fixes what is real first.
A valid login raises no alarm. It is cheaper than brute force, more reliable than credential stuffing and it arrives ready to use from an infostealer log, often with the session cookie that bypasses multi-factor authentication.
Infostealer logs, combolists, breach dumps and underground listings obtained from the channels where they first appear, not only from public feeds, which gives you a window of hours or days before exploitation.
Employees using personal devices and mailboxes, contractors and suppliers with access to your systems, customer accounts on your portals and the SaaS applications your organisation actually uses.
Stolen authentication cookies and tokens that bypass passwords and multi-factor authentication, identified per application and rated by the access they still grant.
Every finding attributed to a person, system and date, de-duplicated against previous reports and rated by severity and confidence. No raw dumps forwarded as alerts.
Under written authorisation, a safe test of whether an exposed credential or session still works, in the style of threat-led testing, to discard false positives and measure real impact.
Indicators that point to the device behind the exposure, so that the infection is cleaned rather than only the password changed, which otherwise leads to repeat exposure.
An annex listing every affected account and asset, with the exact action required, delivered encrypted to the people who will perform the resets and revocations.
Exposed accounts by entity, application and source over time, with the indicators your board, your auditors and your insurer ask for.
Domains, brands, applications, executives, subsidiaries and key suppliers in scope, together with escalation paths and who receives what.
Continuous collection and analyst verification, with alerts within hours for exposures that grant access to corporate systems.
Optional controlled validation of what still works, and prioritisation by the access each exposure grants.
Resets, session revocation and device clean-up tracked to closure, with monthly technical reports and quarterly executive briefings.
Clear, usable outputs for executives, technical teams, insurers and regulators.
Those sites index data long after it has circulated, mostly from large historical breaches. We work from current infostealer logs and underground listings at the point where they first appear, verify them and deliver an action plan, not a notification.
It is stored under strict access controls, used only to protect the client it concerns and never redistributed. Findings about third parties are shared with them only when the client instructs us to.
Yes, under a written authorisation that defines what may be tested and how. The validation is designed to confirm access without reading or changing data beyond what is strictly necessary.
Alerts for critical exposures within hours, a monthly technical report and a quarterly executive briefing. Cadence can be adapted to the client's operating rhythm.
Attackers bought search ads for the word chatgpt, published fake Custom GPTs on the real ChatGPT domain and sent users to a counterfeit Cloudflare check that ends with a PowerShell command. The domain is no longer the signal. The instruction is.
Read article
Sophos links a campaign it tracks as STAC4924 to the group behind Vice Society and Rhysida. The chain hides shellcode as English words, fetches its servers from a forum profile and leaves a Python tunnel on the host. No encryption has been seen yet, which is exactly the point.
Read article
An unauthenticated command injection in the SNMP notification path of Zimbra Collaboration was probed before public disclosure and exploited at scale afterwards. Microsoft's reconstruction shows web shells, a route to root through PAM, credential dumps and a cloud exfiltration attempt. The fix is 10.1.20. The work starts after the patch.
Read articleWant to know whether your people's passwords and sessions are already for sale? Ask for an exposure assessment.