How to check if your company is in stealer logs

What the scan checks

Passguard's scan searches for your domain across the most important criminal marketplaces (dark web forums, Telegram, and Discord). It identifies infected devices that contain sessions, credentials, or cookies associated with your domain. This is fundamentally different from traditional breach monitoring, which only checks against leaked databases from past data breaches.

What to do when your company is found

If the scan reveals that your organisation appears in stealer logs, you should:

• 1. Revoke affected sessions: identify which sessions and credentials are compromised and revoke them immediately. Password resets alone are not sufficient, stolen session tokens remain valid until explicitly revoked.

• 2. Investigate the infected device: use the device information in the log (hostname, OS, IP) to identify and isolate the compromised device.

• 3. Set up continuous monitoring: a one-time scan shows current exposure, but new infections happen continuously. Ongoing monitoring ensures you are alerted to future compromises.

Why regular checking matters

Research by Hadrian and Passguard showed that organisations face multiple infostealer infections per year on average. A single scan shows your current exposure, continuous monitoring catches new threats as they appear. Passguard offers both: a free one-time scan and ongoing monitoring that alerts your security team the moment stolen sessions linked to your domain appear on criminal markets.