Employee credentials in a stealer log
An infostealer on an employee's personal device exfiltrated credentials and an active session cookie for the corporate VPN portal. The record surfaced inside a bulk sale package on …
4 modules
Medium
Example scenario
Impersonation account targeting an executive
An account copying the profile photo and title began direct-messaging employees and business partners.
- Case no
- IG-UC-2026-005
- Threat
- A fake account in the CEO's name messaged employees with an investment pitch.
- Sectors
- Banking & finance, Public sector, Defence
- Roles
- CISO, Brand / Legal
- Outcome
- The platform was notified and an internal advisory was issued.
The InsightGuard approach
The VIP watch list catches new accounts and posts mentioning executive names. The account was detected on the day it was created.
Timeline
Situation → Outcome
-
Account created
An account is created using the executive's public photo and title.
-
Messaging begins
Direct messages go out to employees and business partners.
-
VIP match
The watch list catches the new account and archives the profile.
-
Report filed
An impersonation report is filed and an internal advisory published.
-
Closure
The case closes once the platform removes the account; how long that takes depends on the platform's review. New accounts opened in the same executive's name stay on the watch list.
Related files
Typosquatted domain with a fake login page
Shortly after appearing in certificate transparency logs, the freshly registered domain began serving a copy of the organisation's login page that posted credentials to a third-party server.
3 modules
Third-party risk through a supplier breach
The supplier's customer portal was leaked. The published dataset included API keys, webhook URLs and technical contact emails.
3 modules
Next step
What shows up on your own surface?
In a 30-minute session we run a live scan against your own domains.