What a stolen log can contain

Most infostealer infections happen on unmanaged or personal devices, outside the visibility of antivirus, EDR, or SIEM. Once credentials and session tokens are stolen, they are quietly uploaded to criminal marketplaces and Telegram channels, where these logs are often sold within hours. Each one may include:

• Credentials: for corporate email, VPNs, and admin tools.

• Live session tokens: that bypass MFA entirely.

• Device metadata: IP addresses, OS versions, and browser details.

• Sensitive local files: documents and other files pulled from the device.

• Internal URLs and cookies: tied to internal systems.

Why marketplace monitoring is the most effective approach

Since the infection typically happens off-network, on a device your security stack cannot see, traditional detection tools have little to work with. Monitoring stealer marketplaces directly closes that gap: instead of waiting for symptoms on the device, you watch for your organization’s data appearing where it is being sold, before attackers act on it.

Passguard continuously monitors active infostealer markets and leak channels. If logs tied to your domains or internal tools appear, you are alerted, even if the infection originated from a device you do not control.