Introduction
Dark Radar works with leak data compiled from infostealer logs: credentials, cookies and system information stolen from infected machines.
What the data is
When a machine is infected by an infostealer, its saved browser passwords, session cookies and system details are exfiltrated as an archive. Dark Radar collects, parses and matches these archives against the assets you protect.
A match is a leak event: which value (domain, email, username) was seen, on which machine, and when. The detailed archive is downloadable as inventory once you unlock it.
Why it is time-sensitive
A stolen password or session cookie is usable from the moment it leaks. Seeing it early buys time to reset the password and end the session. That is why connecting the API to your own alerting and workflows matters.
Employee and customer leaks
Corporate leaks belong to your employees and infrastructure — credentials seen on your own domain. Customer (360) leaks are credentials for your service seen on your end users’ infected machines.