Employee credentials in a stealer log
An infostealer on an employee's personal device exfiltrated credentials and an active session cookie for the corporate VPN portal. The record surfaced inside a bulk sale package on …
4 modules
IG-UC · CASE ARCHIVE
Use cases
The anatomy of real CTI cases: how a threat starts, how it is detected and how it is closed. Every file here is an example scenario.
Typosquatted domain with a fake login page
Shortly after appearing in certificate transparency logs, the freshly registered domain began serving a copy of the organisation's login page that posted credentials to a third-party server.
3 modules
Third-party risk through a supplier breach
The supplier's customer portal was leaked. The published dataset included API keys, webhook URLs and technical contact emails.
3 modules
Impersonation account targeting an executive
An account copying the profile photo and title began direct-messaging employees and business partners.
3 modules
Next step
What shows up on your own surface?
In a 30-minute session we run a live scan against your own domains.