Skip to main content

Infostealer Exposure

How does Infostealer Exposure protect your company?

Infostealer Exposure detects when machines are compromised by infostealer malware and the data stolen from them is shared on the Deep and Dark Web. When a malware log contains credentials or access related to your monitored assets, the Axur Platform registers a detection in the Infostealer tab of the Data Leakage workspace, with the evidence and source context.

Instead of showing only a leaked credential, each detection points to the machine and the malware log where the data was stolen. This helps your security and fraud teams to:

  • Identify infected devices and compromised identities – See which machine was infected and which credentials, cookies and other data collected from it;

  • Investigate the exposure – Check how, when and from which machine the data was stolen, using the original evidence;

  • Contain the compromise – Treat the infected machine (for example, with antivirus or reinstallation) in addition to resetting passwords;

  • Identify infection patterns – Compare detections by malware family, source and machine.

Which companies benefit from this monitoring?

Any organization concerned about corporate credentials and sessions being stolen from infected machines can benefit, particularly those that:

  • Want to know when employee credentials or sessions were stolen by malware, and from which device;

  • Need to support SOC, identity and access management, and fraud teams in blocking compromised machines and accounts;

  • Use third-party tools or SaaS platforms and want visibility into credentials stolen for those logins;

  • Want to identify personal or unauthorized devices accessing corporate systems.

How does Infostealer Exposure differ from other Axur products?

  • Infostealer Exposure

    • Restricted to data collected by malware and shared in the original format (the stealer log).

    • Gives a deeper view of the exposure, used to identify and treat the infected machine and to identify the possible source of the infection.

  • Credentials exposure

    • Has a broader scope: detects credentials in different formats, such as combolists and database dumps.

    • Focuses on delivery speed and on credential treatment (password reset, account block and similar).

  • Mentions in data breach

    • Identifies confidential corporate information inside ransomware leaks and breach files.

  • Threat Hunting

    • Allows analysts to manually search across Axur's intelligence datasets for indicators linked to specific investigations.

Several credentials detected in the Credentials tab may have no matching detection in the Infostealer tab. Most credentials are shared in formats such as combolists (url:login:pass, login:pass) or CSV tables. These are not considered malware logs and are not listed as Infostealer detections, even if an infostealer collected the credentials.

Detection rules

Monitored asset

What is matched

Domain

The email domain of the stolen credential. For ormus.com , a credential [email protected] matches, regardless of the site where it was used. The match is exact and case-sensitive.

Third-Party Login Page

The access host or domain of the stolen credential. Only approved assets are monitored.

IP address

The IP address of the infected machine.

IP range (CIDR)

An infected machine whose IP address is inside the range.

A credential with an email from another domain (for example, [email protected]) used on your website does not match a Domain asset.

The matched asset is shown in the Assets column of the detection.

Information available in a detection

The amount of data in each detection depends on the malware family, the threat actor, and the format in which the log was published, so not all information is present in every detection. A detection may include:

  • Malware – Family, distributor, path where the malware was stored, log upload date;

  • System – Operating system, machine name, user account, hardware information, installed software, antivirus, regional settings;

  • Network – IP address, geographic location, ISP;

  • Browser data – Cookies, credentials (URL, login and password), payment data, autofill/form data, running processes;

  • Files on disk – Files in common locations, local configuration files of applications, cryptocurrency wallet files;

  • Screenshots;

  • Source – URL or channel where the leak was published, publication date, author (when available).

Malware families

Axur processes several common malware families, and new ones are added as they appear. Currently supported families:

  • Acreed

  • ArechClientV2

  • Astris

  • AuraStealer

  • Lumma Stealer

  • MacSync

  • Phemedrone

  • Raccoon Stealer

  • Raven

  • Redline Stealer

  • Remus

  • Rhadamanthys Stealer

  • RisePro Stealer

  • Stealc Stealer

  • Stealerium

  • Vidar Stealer

  • WhiteSnake

  • XFiles

When a family is not yet known, the log is still detected without a family assigned.

Duplicated logs

Infostealer logs are not deduplicated, because a new detection can mean the machine is still infected or was infected again. However, if a collected archive has exactly the same content as an archive already processed, it is discarded before ingestion. For example, when the same .zip file is shared in two Telegram channels, only the first one is processed.

Monitored sources

  • Telegram

  • Deep and Dark Web forums

  • Threat actor groups web pages

Additional sources monitored by Axur's Threat Intelligence Team

How to set up your monitoring

Infostealer Exposure uses your Data Leakage assets. Monitoring is enabled per asset at Monitoring Settings > Asset management.

Supported assets:

  • Domain

  • Third-Party Login Page

  • IP address

  • IP range (CIDR)

  1. Access Monitoring settings > Asset management and open the Digital Risk tab.

  2. Click the asset you want to monitor (for example, a Domain asset). The asset edit page opens.

  3. In the Monitoring setup section, under Data Leakage, turn on Infostealer exposure.

  4. Click Save asset.

Historical detections

Infostealer logs are available since the release of the feature (April 2026). Logs collected before that date are not available, and enabling monitoring on a new asset does not create detections for logs processed before it was enabled.

Granting user access to the detections

Infostealer detections contain sensitive information about infected machines, so access is controlled per user. Managers can enable or disable the access of each user.

  1. Click the Settings (gear) icon and select My team.

  2. Find the user you want to update, click the ellipsis (three dots), and select Edit.

  3. In the permissions, enable or disable the Infostealer permission.

Infostealer is enabled by default. If a user's access to Data Leakage detections is restricted to specific detection types, Infostealer must be selected in that list for the user to see Infostealer detections.

Detection management

Detections are accessible in the Infostealer tab of the Data Leakage workspace.

The table shows, by default, these columns: Creation date, Status, Assets, Hardware ID, Computer IP, Computer hostname, OS name, and Tags. Use Export CSV to export them.

How to investigate the evidence of a detection

Each detection represents one infected machine and the data that malware stole from it. The side panel brings together everything Axur could extract from the log, so you can answer four questions: who was affected, which device was infected, what was exposed, and how/when the data got out.

When you click a detection, a side panel opens with its details, organized in three tabs:

  • Details: the information about the detection, the machine and the original log;

  • Notes: lets you add your own notes to the detection, for example the ticket number, the owner of the investigation or the actions taken;

  • Events history: the changelog of the detection, showing what was changed over time.

The amount of data varies according to the malware family and the format in which the log was published, so some fields may be empty ("-"). Use the following sections of the Details tab to build your analysis:

  • Summary: detection ID, status, dates, matched asset, tags. The Assets field shows which of your monitored assets matched, so you know whether the exposure involves your domain, a third-party login page or an IP address. The dates help you build the timeline between the publication of the leak and its detection;

  • Records: lists the data stolen from the machine, by type. It is the core of the investigation, see Investigating the records below;

  • Malware: stealer family, malware distributor and stealer executable path. Use the family and distributor to understand the threat and to recognize repeated campaigns across detections. Use the executable path as an indicator to search for and remove the malware on the device (for example, in your EDR or antivirus console);

  • Machine: hardware ID, hostname, IP , MAC address, CPU, GPU, RAM, disk and screen size. Use the hostname, IP and MAC address to locate the device in your asset inventory, EDR or MDM. When the machine is not in your inventory, the hardware details help you identify whether it is a personal or unauthorized device accessing corporate resources (Shadow IT);

  • Operating system: OS name and version, user, administrator flag, language, keyboard, time zone, installed antiviruses and installation date. The OS user helps you identify the person affected, the administrator flag shows how much control the malware could have had, and the installed antivirus shows which protection was in place and did not stop the infection;

  • Geolocation: country, region and city of the machine. Compare with the expected location of the user to spot unexpected devices;

  • File: name, size and source package of the compressed file where the log was found. Useful to correlate several detections that came from the same package and to validate the evidence in the original file;

  • Source: where the leak was published and when (name, URL and exposure date at the source). Use the exposure date to estimate how long the data has been available to criminals and prioritize your response;

  • Message: for leaks shared on messaging apps such as Telegram, the message and chat details (chat name and type, author, date). Shows the context and how broadly the log was distributed;

  • Folder: the folder inside the package that corresponds to this detection. One package can contain thousands of logs, each from a different machine, and each detection points to a single folder;

  • Leak and Mega: details of the leak, generated only when the detection comes from those sources;

  • Other information: additional identifiers of the detection.

Investigating the records

The Records section lists every record type: Credentials, Credit cards, Cookies, Autofill, Software, Processes and Files. Types with records show a View table link; the others show "-". Each type answers a different question:

  • Credentials (URL, login and password): show which accounts and services were exposed, including corporate systems and third-party tools. Use them to define which passwords must be reset and which accounts to review;

  • Cookies: session cookies can allow an attacker to access an account without the password. Invalidate the sessions of the exposed accounts, even if the password was already changed;

  • Autofill: data saved in browser forms, such as names, addresses, phone numbers and other identifiers. Shows which personal information of the user is exposed;

  • Credit cards: payment data saved in the browser, when present. Allows the affected cards to be blocked;

  • Software: applications installed on the machine. Help you identify whether the device runs unauthorized software and how the infection may have started;

  • Processes: programs running on the machine when the data was collected. Help you identify the malware and other suspicious activity on the device;

  • Files: files collected from the machine, such as documents, configuration files of applications (VPN, FTP , password managers, email) and cryptocurrency wallets. Check whether they contain sensitive corporate information or access credentials that must be revoked.

To work with the records:

  1. View: select a record type to see all records of that type found in the malware log. A single detection can contain thousands of records;

  2. Search: use the search field inside a record list to find specific values, for example your domain, the name of a corporate system or a username, instead of scrolling through the whole list;

  3. Validate: for a record, preview or download the original file where it was found, to compare it with the raw evidence and confirm the exposure before taking action.

Accessing files and performing investigations

From the side panel, you can:

  • Download an individual file;

  • Download the original package (the full compressed archive associated with the detection).

Files remain available for one year after collection, respecting download usage and legal boundaries. Automated or bulk unauthorized downloading is not permitted.

Please be advised that all files are provided as collected and have not been inspected for malware. Axur strongly recommends utilizing a Sandbox environment during investigation.

What to do after a detection?

  • Identify the infected machine using the machine, IP and hardware information of the detection;

  • Treat the machine (for example, antivirus scan or reinstallation) and block it from accessing corporate systems;

  • Reset the passwords and invalidate the sessions of the exposed accounts;

  • Use the original file to validate the evidence;

  • Add notes and update the status to reflect progress.

API & Integrations

  • Exposure API: infostealer detections are available in the infostealer category of the Exposure API (search, count, status, notes and tags). See the Axur API Documentation.

  • Integration feeds: feeds of type Infostealer are available at the API & Integrations screen, in Pull and Push modes. See Feeds.

The Axur Data Connector for Splunk is not available for Infostealer Exposure.

Webhooks

Webhooks 2.0 (Feed Push) are configured at the API & Integrations screen, using a feed of type Infostealer. See Feeds.

Notifications

Email alerts for infostealer detections are not available yet. They are in development.

Safelist

Infostealer Exposure does not have a safelist.

Related Articles
Did this answer your question?