Early warning against infostealers
Stop attackers before an infostealer lets them into your systems.
One infected laptop is enough: an infostealer copies an employee's saved passwords and session cookies, soon afterwards they are offered on the dark web, and with a cookie that is still valid the buyer gets past the second factor. If a new stealer log for your domains turns up in the data we check, the DarkWeb Scanner learns of it in real time and reports an employee's fresh log at once. With the Corporate plan and above, it uses emergency access that you set up to replace the password of a cloud-only account in Microsoft 365 or Google Workspace and then revoke the account's sign-in sessions: the stolen password no longer works there, and a stolen sign-in cookie of the account requires a new sign-in there.
Built for businesses without their own security team. Access on request, cancelable monthly, with no software on your employees' computers.
How an infostealer attack unfolds
Between the theft and the first access there is a window. That is where we step in.
The attacker does not break in; they use access they have bought. Until then, the access can be closed: a new password, revoked sessions, a cleaned device. After that, the attacker is inside.
-
A computer gets infected
An attachment, a fake update, a program from the internet, even on a personal laptop where someone signed in to their company account. In seconds the infostealer copies what the browser has saved: passwords, session cookies, form data.
-
The data is up for sale
Soon afterwards the package sits on a marketplace or in a channel as a stealer log, for a few dollars and searchable by domain. Buyers are often not after one particular company but after access that works: Microsoft 365, VPN, Citrix.
-
This is where we step in
We alert you, you close the door
If the log turns up in the data we check, the DarkWeb Scanner learns of it through your domain in real time, rates an employee's fresh log as critical and reports it at once; the alert shows the account, application and date. With the Corporate plan and above, it uses your emergency access to replace the password of a cloud-only account in Microsoft 365 or Google Workspace and then revoke the account's sign-in sessions, at the push of a button or automatically.
-
Without early warning: the attacker gets in
With a cookie that is still valid, the buyer takes over a session that is already signed in, with no password, no second-factor prompt, no failed attempt and often no alarm; the person simply seems to carry on working. From the mailbox, the attacker moves on to files, remote access and servers, and what can follow is payment fraud from the real mailbox, data theft or ransomware.
Misconceptions
What many consider safe, and where the gap is.
Each of these statements is true as far as it goes. It only becomes dangerous when it turns into a reason to do nothing more.
-
Misconception 1
I have 2FA turned on, so I am safe.
Two-factor sign-in remains the right choice and belongs on every account: against a stolen password alone it is the most important hurdle. But it only checks the moment of signing in. An infostealer copies the session cookie of a browser that is already signed in, and whoever replays it takes over that session without ever being prompted for the second factor, for as long as the session is valid and nothing binds it to the original device.
What helps: We treat an employee's fresh stealer log as critical and mark it in red as a likely stolen session; with the Corporate plan and above, the application replaces the password of a cloud-only account in Microsoft 365 or Google Workspace and then revokes the account's sign-in sessions.
-
Misconception 2
I have a backup, so ransomware is nothing for me to worry about.
A backup brings availability back: your systems run again, often only after days, and only if the attackers have not encrypted or deleted the backup as well. It does not bring back confidentiality: extortion groups now often copy the data before they encrypt it, and threaten to publish it. Customer data, contracts and payroll lists on the internet can mean reporting obligations, liability and lost trust, and no backup undoes that.
What helps: Close stolen access before it becomes a way in, and have your domain checked regularly for mentions on extortion groups' leak sites.
-
Misconception 3
I have cyber insurance, so I am covered.
Insurance pays after the damage, it cannot prevent it, and it pays only within the agreed scope. Many policies tie their coverage to obligations such as two-factor sign-in, updates and backups, and they have exclusions; if you declare measures that are not actually in place, you risk the payout exactly when it gets expensive. Published customer data and lost trust are things it cannot bring back.
What helps: The policy is there for the damage, we are there for the time before it: every alert records when it appeared, who is responsible for it and which steps were checked off, so you can show that you acted.
-
Misconception 4
My IT provider has everything under control, I have a full-service contract.
Your IT provider looks after your systems: servers, firewall, updates, backups, often Microsoft 365 as well. But access is stolen outside all that, for example on a personal laptop they never get to see, and a sign-in with it looks like your employee's. A full-service contract covers operations and outages; whether it also covers looking for stolen credentials is in the contract, so ask. Without it, even a good provider usually only steps in once something is noticed, and by then the attacker is often already inside.
What helps: We find the log through your domain, whatever device it came from, and with the Corporate plan and above every new alert at or above the severity you choose lands as a ticket in Jira or ServiceNow or as a message in Teams or Slack, so it reaches your provider directly.
-
Misconception 5
We are too small, nobody is interested in us.
An infostealer does not pick a company: it is spread widely, through attachments, fake downloads and ads, and takes whatever it finds from every device. The sorting only happens at the point of sale, and what gets bought is what works, not only what is big. A small business is also a route to its customers: from the real mailbox, an invoice with a new IBAN can be sent convincingly.
What helps: Even the Business plan watches your domain for stealer logs, combolists and database leaks; all plans watch domains and e-mail addresses equally well.
-
Misconception 6
Our antivirus would catch an infostealer.
Antivirus is necessary and catches a lot. But an infostealer is done in seconds and is changed constantly so that detection patterns miss it; a stealer log often even records which antivirus was running on the device. A personal laptop does not run yours anyway, and what has been copied is not brought back by a later cleanup.
What helps: We do not look on the computer; we search the data we check for your domain, even if the device does not belong to the company. The checklist on the alert starts with isolating the device.
-
Misconception 7
We have strong passwords and a password manager.
Both are good practice and protect against guessed and reused passwords. But an infostealer does not guess, it reads: the password saved in the browser, the session cookie along with it, and if the password manager was unlocked at that moment, its entire contents must be treated as stolen. A strong password is then a strong password in someone else's hands.
What helps: Alerts can be grouped by infected device, so you see which of your accounts the same computer gave away; with the Enterprise plan, the check against your Active Directory shows whether a leaked password is still valid today.
-
Misconception 8
We would notice a break-in right away.
With valid credentials, access looks like normal work: no failed attempts, with a stolen session cookie not even a second-factor prompt, and often no alarm. To the system, an employee is simply carrying on with their work. Such access is often only noticed by its consequences: a diverted payment, an unfamiliar forwarding rule in the mailbox or encrypted drives.
What helps: The signal comes with the log, not with the consequences: a new stealer log for your domain reaches us in real time, and we report it at once, ideally before the first access. Every alert gets a deadline by severity and can be assigned to a person.
-
Misconception 9
Our data is with Microsoft, they take care of security.
Microsoft protects the platform: data centers, servers, software. Whoever signs in with a valid password or replays a valid session cookie looks, to Microsoft, like the authorized user at first; whether unusual access is detected and blocked depends on licenses and policies that you set up yourself. Accounts, permissions and sign-in policies are your side of the shared responsibility, and one company account often opens mail, files and Teams all at once.
What helps: With the Corporate plan and above, the application acts right there: through emergency access that your IT sets up and protects like an administrator account, it replaces the password of a cloud-only account in Entra ID or Google Workspace and then revokes the account's sign-in sessions.
-
Misconception 10
If something turns up, we will just change the password.
A new password does not end active sessions on every service; a stolen cookie can stay valid until they are explicitly revoked. Order matters: replace the password first, then immediately revoke every session, because revoking first leaves the attacker time to start a fresh session with the old password. And as long as the device stays infected, the new password will be in the next log.
What helps: With the Corporate plan and above, the immediate measures keep this order in Microsoft 365 or Google Workspace, and the checklist on the alert guides you through the steps on the device.
Features
An early-warning system for the time before the break-in.
You name your domains, with no software on your employees' computers: new stealer logs for them reach us in real time, and everything else is checked every day. We report new urgent findings at once and bundle everything else in the weekly report; each area is described in detail under Features.
-
Infostealer early warning
Stealer logs for your domains; an employee's fresh log is critical, reported at once and marked as a likely stolen session. With the Corporate plan and above, the application replaces the password of a cloud-only account in Microsoft 365 or Google Workspace and then revokes the account's sign-in sessions, at the push of a button or automatically.
Learn more: Infostealer early warning -
Stolen credentials
Passwords from combolists and database leaks, one row per leak, rated by content and age: an old breach holding only an e-mail address and a name shows as low. If a new password turns up for an address, a resolved alert reopens.
Learn more: Stolen credentials -
Your outside view
Forgotten hostnames, open ports of verified domains, lookalike domains with a note on whether they can already receive mail, SPF, DKIM and DMARC, and whether your domain is named on extortion groups' leak sites.
Learn more: Your outside view -
Alerts without the noise
New high and critical findings at once by e-mail, and on request also by Telegram, Slack, Teams or Threema; everything else bundled in the weekly report. For management, a PDF report with a risk score per domain is ready to download every month.
Learn more: Alerts without the noise -
Clear responsibility
Every alert gets a deadline by severity and can be assigned to a person; an exception quietly files what is known, and anything new still comes through. With the Corporate plan and above, every new alert at or above the severity you choose goes out as a message in Slack or Teams or as a ticket in Jira or ServiceNow.
Learn more: Clear responsibility -
For your IT provider
IT providers look after several clients from one sign-in: their own team, setting up clients, working inside a client, their clients' warnings included, one invoice for all.
Learn more: For your IT provider
Prices from CHF 49 per month, plus VAT · See the price list
Make stolen access worthless before anyone uses it.
Access is by request: you give us your company, your name and your e-mail address; we review the request and give you access. We can grant a free trial with the invitation. The first check shows what is already known; the value lies in every day that follows.