Request demo

Compromised Employee Device Monitoring

One Infected Laptop Leaks Every Saved Login.

Infostealer malware copies what a browser keeps: saved passwords, session cookies, autofill entries, tokens. The log it produces is sold or shared on dark web markets and chats.

The Deepinfo Platform finds the devices in those logs that belong to your employees and shows, device by device, what each one exposed.

Request demo

ACME-LT-

Infostealer log

j. · Windows 11 Pro x64 · en-GB · an employee laptop, its log sold on a dark web market

  1. Infected device CTIone device, counted once

    HWID

  2. [Passwords]41 saved

  3. Your SSO login CTIwith its password

    URLhttps://sso.acme.example/login

    USER j.@acme.example

    PASS

  4. The host nobody listed EASMand now its password

    URLhttps://vpn-legacy.acme.example

    USER j.

    PASS

  5. Session cookies CTIpast the password and MFA

    [Cookies]1,208 · 36 sensitive

  6. [Autofill] · [Tokens]312 · 4

  7. Password reuse CTIone password, many sites

    SamePassword63%

Tied to one device, one account and one person, so your team resets the right login and cleans the right laptop.

Record openednewly_detected

What the Platform Records per Device.

Hardware IDThe machine identifier the stealer recorded, the key for matching a log to a device
User infoUsername, machine name, country and operating system: enough to find the device in your fleet
System infoCPU, RAM, GPU and the installed antivirus
Software and browsersInstalled software and browsers, with versions
Password countHow many logins the browser had saved
Token countAuthentication tokens found in the log
Cookie and sensitive cookie countAll cookies, and the ones that can carry a live session
Autofill countForm entries the browser remembered
Same-password rateHow often one password is reused across the sites in the log

The API filters devices on these fields and more. See the Compromised Device Search reference.

The Signals That Set the Priority.

Some infected devices are more urgent than others. These fields decide which one your team opens first.

Sensitive Cookie Count

A live session cookie can let an attacker skip the password and the MFA prompt. Put devices with sensitive cookies at the top of the queue.

Saved Corporate Logins

Each leaked employee credential keeps the URL it was saved for, so a login for your SSO, VPN or mail is visible as such.

Same-Password Rate

A high reuse rate means one leaked password probably opens more than the site it was saved for.

From the Device to the Employee.

Each device record links to an employee account. Accounts carry a risk score and a risk level (low, medium, high or critical), first and last exposure dates, and a password profile: unique passwords, average strength, weak-password share and reuse.

Flag executives and set departments on each account, then filter the queue on them. Leaked employee credentials are tracked as records with states: each arrives as newly_detected and stays open until your team resolves it, accepts the risk, ignores it or marks it false positive, in bulk by filter.

Compromised Device Search referencePlatform guide: Compromised employees
Devices for one email domain 
curl -X POST "https://api.deepinfo.com/v1/cti/compromised-devices" \
  -H "apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"filters": {"must": [
        {"name": "account.email", "type": "endswith", "value": "@acme.example"}
      ]}}'

What to Do With a Device Record.

  1. 01

    End sessions

    Revoke active sessions on the employee’s corporate accounts. A password reset alone can leave a stolen session working.

  2. 02

    Rotate credentials

    Reset the corporate passwords the browser had saved. A high same-password rate widens the list.

  3. 03

    Find the machine

    Use the machine name, username and hardware ID to locate the device in your inventory and send it for cleanup.

  4. 04

    Close the record

    Mark the credentials resolved once the work is done, so the queue shows only what is still open.

The Rest of the Credential Picture.

Breaches and customer credentials cover the exposure a device log does not.

CTI Employee Email Breach Monitoring Corporate addresses exposed when a third-party service is breached. Read CTI Compromised Client Credential Monitoring Infostealer leaks from your customers’ devices. Read CTI Threat Actor Intelligence Actor profiles with the forums, markets and tools each one uses. Read

Query This Data Through the API

Credentials and dark web findings stay in the Deepinfo Platform. The domain and vulnerability data around them is open through the API.

Questions About Compromised Employee Device Monitoring

What is an infostealer?

Malware built to copy credentials and session data from an infected machine: saved browser passwords, cookies, autofill entries and tokens. The output is a log per device, which is then sold or shared on dark web markets and chats.

Isn’t this what our EDR is for?

EDR sees the devices you manage. Infostealer logs also include personal and unmanaged machines where an employee signed in to work systems, which your own tooling never sees.

Can we see whether new exposures are slowing?

Yes. The exposure timeline counts newly exposed employee credentials per day, week or month, and each employee account shows how often new credentials of its own appear and whether that pace is rising.

Can we pull device records into our own tools?

Yes. Compromised Device Search filters on account, operating system, installed software, browsers and antivirus, and each device has a detail endpoint. Employee accounts and credentials have their own search, export, statistics and bulk state endpoints in the CTI reference.

See Which Employee Devices Are Already in Logs.

Book a demo and we’ll look at infostealer exposure for your corporate domains with you, device by device.

Request demo