en
Detect leaked credentials, stealer logs, exposed tokens, and dark web threats. Monitor, investigate, and respond before attackers exploit them.
Search by company name or domain to see whether our current threat-intelligence dataset contains credential records associated with the organization's email domain.
Search results use exact email-domain intelligence. They do not verify domain ownership or guarantee complete coverage.
Stolen access doesn't surface in one place. We watch every corner where credentials, cards, code, and customer data change hands. The moment your name appears in fresh data, you find out before it costs you.
Underground markets where employee logins, customer accounts, and SaaS access are bought and sold every day. We surface them before they're priced into your next breach.
Private Telegram and Discord groups where access brokers and stealer crews advertise victims by name, sector, and country. Your name showing up here is an early warning we hand to you.
Open paste sites, gist boards, and exposed cloud buckets where credential dumps and customer databases get posted in plain sight, often before the victim realizes they've been hit.
Every active ransomware leak site, monitored continuously. The moment your organization or a key supplier is named, you know about it before the news cycle picks it up.
When an employee's device is compromised, every saved password, session cookie, and API token leaves with the attacker. We catch the victim record and tell you exactly which assets to rotate.
Leaked source code, exposed CI logs, public repos with secrets inlined. We surface them and tell you precisely which token, key, or namespace belongs to your team.
These figures come directly from CyStack's current threat-intelligence indexes and continuously refreshed info-stealer catalog.
Compromised accounts
Credential observations in the dataset; one person may be represented by multiple records.
17,123,628
Compromised machine records
Infected-device IOC records; not necessarily unique physical devices.
52
ATT&CK techniques mapped
Distinct MITRE ATT&CK technique IDs mapped across the current catalog.
Full victim profile context (device, country, time of theft) is provided to help SOC teams investigate immediately.
Login credentials for corporate SaaS platforms such as Microsoft 365, Google Workspace, AWS, and GitHubCredentials for internal corporate systems and VPNsActive session cookies that can bypass password resets and MFACustomer accounts and organization loyalty program credentialsAutofill data saved across browser password managers and form autofills{
"id": "8a3f2e1c0bd1c5f4a829",
"software": "Chrome 124.0.6367.91",
"url": "https://mail.google.com/mail/u/0/",
"username": "alice@acme.com",
"password": "Hunter2!sUmm3r",
"username_domain": "acme.com",
"url_domain": "google.com",
"cookie_count": 187,
"autofill_present": true,
"source": "telegram/stealer-feed-3/78231",
"source_origin": {
"chat": "stealer-feed-3",
"msg_ids": [
194112,
194113
],
"doc_ids": [
"78231"
],
"bundle": "july17_logs_part01.rar",
"member": "[CC]1.2.3.4/Soft/Chrome/Login Data"
},
"ioc_id": "3a7f9c1e0bd1ae72b104",
"ingested_at": 1746762120483
}{
"id": "8a3f2e1c0bd1c5f4a829",
"software": "Chrome 124.0.6367.91",
"url": "https://mail.google.com/mail/u/0/",
"username": "alice@acme.com",
"password": "Hunter2!sUmm3r",
"username_domain": "acme.com",
"url_domain": "google.com",
"cookie_count": 187,
"autofill_present": true,
"source": "telegram/stealer-feed-3/78231",
"source_origin": {
"chat": "stealer-feed-3",
"msg_ids": [
194112,
194113
],
"doc_ids": [
"78231"
],
"bundle": "july17_logs_part01.rar",
"member": "[CC]1.2.3.4/Soft/Chrome/Login Data"
},
"ioc_id": "3a7f9c1e0bd1ae72b104",
"ingested_at": 1746762120483
}Full victim profile context (device, country, time of theft) is provided to help SOC teams investigate immediately.
Login credentials for corporate SaaS platforms such as Microsoft 365, Google Workspace, AWS, and GitHubCredentials for internal corporate systems and VPNsActive session cookies that can bypass password resets and MFACustomer accounts and organization loyalty program credentialsAutofill data saved across browser password managers and form autofillsA seamless experience for SOC, anti-fraud, legal, and company leadership alike.
Every piece of information is available on one unified interface to help you decide faster.
Monitor every type of digital asset and related data, including:
Website domainsBrand names / Intellectual propertyEmployee emails and PIIBIN ranges / Payment data *Namespaces / Source code / Secrets *Executive identity information ** Executive personal information or payment card data requires additional keywords or data to be provided so Threat Intelligence can search more effectively
Centralized Digital Asset Management
Monitor every type of digital asset and related data, including:
Website domainsBrand names / Intellectual propertyEmployee emails and PIIBIN ranges / Payment data *Namespaces / Source code / Secrets *Executive identity information ** Executive personal information or payment card data requires additional keywords or data to be provided so Threat Intelligence can search more effectively
Rapid Tracing & Investigation
Multi-Context Search
Communication & Collaboration
CyStack Threat Intelligence collects the highest-value data tailored to your industry vertical and real threats active in your region.
Every risk and related activity is traceable back to its origin, including timestamps and all associated activity.
Real-time data feeds, 24/7 intelligence updates, and flexible integration supportExpert-managed service with rapid validation and high-confidence verificationFor lean teams getting CTI off the ground
0 USD
/domain/month
Unlimited domainsSelf-service tuning & verificationLimited number of results shownWildcard searchExport resultsFor lean teams getting CTI off the ground
From 19.99 USD
/domain/month
View all resultsTrack data leaks by vendor and affected organizationReal-time notificationsAdvanced contextual searchFor SOCs running professional CTI
From 199.99 USD
/keyword/month
Support for all keyword types*CyStack experts help build your keyword setWebhook and SIEM/SOAR integrationPeriodic reports* For security reasons, keywords other than domains owned by your business must be reviewed by CyStack
Optimized for organizations operating their own security infrastructure, with full integration support for existing environments
Skip the staffing challenge. Our team triages, investigates, and responds on your behalf, 24/7. Your organization receives only what matters most.
Noise Elimination Through Automated and Manual Filtering
Direct Takedown and Risk Remediation Support
On-Demand and Scheduled Threat Investigations
Executive-Grade Reporting for CISOs and Stakeholders
Understand how CyStack helps security teams discover and act on external exposure before attackers can exploit it.
A threat intelligence platform collects, normalizes and enriches security data from external sources so teams can identify relevant threats, investigate exposure and coordinate a response. CyStack focuses on actionable risks connected to your organization's domains, identities, assets and suppliers.
CyStack monitors exposed accounts, session cookies, API tokens, payment cards, source code, confidential documents and related indicators found in stealer logs, underground markets, messaging channels, ransomware leak sites and public repositories.
CyStack parses observed info-stealer log formats, connects compromised identities to affected devices and organizations, enriches the evidence and prioritizes records that security teams can verify and remediate. The public info-stealer catalog documents the malware families covered by this research.
Teams can investigate evidence in the dashboard, tune monitoring around domains and keywords, export findings, receive real-time notifications and integrate alerts with webhooks or SIEM/SOAR workflows. CyStack also offers analyst-led investigation and remediation support.