# Compromised Employee Device Monitoring

URL: https://www.deepinfo.com/platform/cti/compromised-employee-device-monitoring/

## One Infected Laptop Leaks Every Saved Login.

Infostealer malware copies what a browser keeps: saved passwords, session cookies, autofill entries, tokens. The log it produces is sold or shared on dark web markets and chats.

The Deepinfo Platform finds the devices in those logs that belong to your employees and shows, device by device, what each one exposed.

[Request demo](https://www.deepinfo.com/request-demo/)

### What the Platform Records per Device.

- **Hardware ID**: The machine identifier the stealer recorded, the key for matching a log to a device
- **User info**: Username, machine name, country and operating system: enough to find the device in your fleet
- **System info**: CPU, RAM, GPU and the installed antivirus
- **Software and browsers**: Installed software and browsers, with versions
- **Password count**: How many logins the browser had saved
- **Token count**: Authentication tokens found in the log
- **Cookie and sensitive cookie count**: All cookies, and the ones that can carry a live session
- **Autofill count**: Form entries the browser remembered
- **Same-password rate**: How often one password is reused across the sites in the log

The API filters devices on these fields and more. See the [Compromised Device Search reference](https://docs.deepinfo.com/reference/cti/compromised-device-search/).

### The Signals That Set the Priority.

Some infected devices are more urgent than others. These fields decide which one your team opens first.

#### Sensitive Cookie Count

A live session cookie can let an attacker skip the password and the MFA prompt. Put devices with sensitive cookies at the top of the queue.

#### Saved Corporate Logins

Each leaked employee credential keeps the URL it was saved for, so a login for your SSO, VPN or mail is visible as such.

#### Same-Password Rate

A high reuse rate means one leaked password probably opens more than the site it was saved for.

### From the Device to the Employee.

Each device record links to an employee account. Accounts carry a risk score and a risk level (low, medium, high or critical), first and last exposure dates, and a password profile: unique passwords, average strength, weak-password share and reuse.

Flag executives and set departments on each account, then filter the queue on them. Leaked employee credentials are tracked as records with states: each arrives as `newly_detected` and stays open until your team resolves it, accepts the risk, ignores it or marks it false positive, in bulk by filter.

[Compromised Device Search reference](https://docs.deepinfo.com/reference/cti/compromised-device-search/) · [Platform guide: Compromised employees](https://docs.deepinfo.com/guide/cti/compromised-employees/)

Devices for one email domain

```bash
curl -X POST "https://api.deepinfo.com/v1/cti/compromised-devices" \
  -H "apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"filters": {"must": [
        {"name": "account.email", "type": "endswith", "value": "@acme.example"}
      ]}}'
```

### What to Do With a Device Record.

1. **End sessions**

   Revoke active sessions on the employee’s corporate accounts. A password reset alone can leave a stolen session working.
2. **Rotate credentials**

   Reset the corporate passwords the browser had saved. A high same-password rate widens the list.
3. **Find the machine**

   Use the machine name, username and hardware ID to locate the device in your inventory and send it for cleanup.
4. **Close the record**

   Mark the credentials resolved once the work is done, so the queue shows only what is still open.

### The Rest of the Credential Picture.

Breaches and customer credentials cover the exposure a device log does not.

- [Employee Email Breach Monitoring](https://www.deepinfo.com/platform/cti/employee-email-breach-monitoring/) (CTI): Corporate addresses exposed when a third-party service is breached.
- [Compromised Client Credential Monitoring](https://www.deepinfo.com/platform/cti/compromised-client-credential-monitoring/) (CTI): Infostealer leaks from your customers’ devices.
- [Threat Actor Intelligence](https://www.deepinfo.com/platform/cti/threat-actor-intelligence/) (CTI): Actor profiles with the forums, markets and tools each one uses.

### Query This Data Through the API

Credentials and dark web findings stay in the Deepinfo Platform. The domain and vulnerability data around them is open through the API.

- [Vulnerability Search API](https://www.deepinfo.com/data-api/apis/vulnerability-search/)
- [Vulnerability Detail API](https://www.deepinfo.com/data-api/apis/vulnerability-detail/)
- [Domain Detail API](https://www.deepinfo.com/data-api/apis/domain-detail/)
- [WHOIS History API](https://www.deepinfo.com/data-api/apis/whois-history/)

### Questions About Compromised Employee Device Monitoring

**What is an infostealer?**

Malware built to copy credentials and session data from an infected machine: saved browser passwords, cookies, autofill entries and tokens. The output is a log per device, which is then sold or shared on dark web markets and chats.

**Isn’t this what our EDR is for?**

EDR sees the devices you manage. Infostealer logs also include personal and unmanaged machines where an employee signed in to work systems, which your own tooling never sees.

**Can we see whether new exposures are slowing?**

Yes. The exposure timeline counts newly exposed employee credentials per day, week or month, and each employee account shows how often new credentials of its own appear and whether that pace is rising.

**Can we pull device records into our own tools?**

Yes. Compromised Device Search filters on account, operating system, installed software, browsers and antivirus, and each device has a detail endpoint. Employee accounts and credentials have their own search, export, statistics and bulk state endpoints in the [CTI reference](https://docs.deepinfo.com/reference/cti/).

### See Which Employee Devices Are Already in Logs.

Book a demo and we’ll look at infostealer exposure for your corporate domains with you, device by device.

[Request demo](https://www.deepinfo.com/request-demo/)