Dark Web Monitoring

Dark Web Monitoring is a term you’ll likely be hearing more and more. And no wonder — the dark web and its marketplaces are exactly where stolen login credentials, personal data, and other sensitive information from hacked services or infected computers tend to end up.

But where does this data actually come from? And what can attackers really find out about you? Let’s take a deeper look — including some real-world findings from our own investigations.

Infostealers: Quiet Thieves That Take Everything

An infostealer is a type of malware designed to silently collect anything valuable from a compromised computer: stored passwords, private key files, password manager databases, crypto wallet seeds, MFA QR codes, clipboard contents, cookies — even screenshots. All of this is sent straight to the attacker.

Infostealers are most commonly found on personal (home) devices, which are usually much less secure than corporate-managed machines. In most cases, victims infect themselves — by clicking a phishing email, falling for a fake “QuickFix” (aka fake captcha), or installing pirated software.

And it’s pirated software that we see as one of the biggest problems. Just think about it — if someone can code a working crack, they likely know how to inject malware that won’t be flagged by antivirus. And many users are already in the habit of disabling antivirus just to get cracks working.

This is one of the reasons the attitude toward BYOD (Bring Your Own Device) is starting to shift. For companies with serious security needs, BYOD is increasingly seen as a liability.

Field Notes: Interesting Observations

Advanced Users = Higher Risk?

We often find credentials of people who, frankly, should know better — sysadmins, developers, helpdesk admins. These are folks with deep technical knowledge, but maybe that’s the problem. They trust themselves too much. They assume they’ll recognize malware if they see it. All it takes is one bad download.

Unfortunately, these users often have access to critical systems. So when their credentials leak, the impact is much greater — and much more expensive.

Hundreds of Passwords from a Single PC

It may sound hard to believe, but a single infected machine can easily leak hundreds of passwords. Some are stored in the browser, others captured by a keylogger. Cleaning up — rotating hundreds of passwords — can take days. If you even realize it in time.

MFA Won’t Save You

One of the most common assumptions we hear is: “But we use multi-factor authentication — we’re safe.”

Unfortunately… not quite. Infostealers steal session cookies too. That means attackers can hijack an already-authenticated session — no password, no MFA, not even phishing-resistant methods are needed.

When Attackers Know Who You Are

Infostealers often collect information from logged-in profiles — like Facebook or LinkedIn — and auto-filled form data from e-shops (name, email, shipping address, phone number…).

That means attackers don’t just get credentials — they know exactly who they’ve compromised. They often have the victim’s full name, street address, phone number, and email — all automatically harvested from autofill forms.

Even Criminals Screw Up

Some attackers accidentally infect their own machines with an infostealer (yep, really 🤦‍♂️). Often it happens because they too rely on cracked software and get burned by one of their own.

Once infected, their entire digital identity leaks — email access, login credentials, crypto exchange accounts, screenshots, browsing history… Suddenly, their “anonymous” criminal persona is mixed in with their real-world identity. And that can be enough to track them down.

Don’t Forget About Files

Infostealers also collect files that look interesting. Like .txt or .xlsx files with passwords, exported vaults from password managers, or configuration files with embedded credentials.

So if someone’s still thinking “I just keep my passwords in Excel, it’s fine”… Sorry, but no. It’s not.

So What Exactly Is Dark Web Monitoring?

In short, we continuously monitor the dark web and underground marketplaces for leaked data connected to our clients. If we detect anything, we immediately alert the affected user. In most cases, this means their personal computer has already been compromised.

We then begin resetting passwords, locking down access, and checking whether anything has already been abused. The goal is to detect and contain the incident before things spiral out of control.

Dark Web Monitoring is a natural extension of the security work we already do for our clients. From a cost-benefit perspective, it just makes sense — it’s much easier to reset a few passwords than deal with a full-scale breach or ransomware incident.

So how do we get access to this data?

We work with a specialized partner — Hudson Rock — who focus on infostealer data analysis and dark web intelligence. They have outstanding research, proprietary technology, and broad data access. We add our own tools, experience, and detection logic on top.

Wrapping Up

I know it’s been a while since I published anything here. Lately, I’ve been deep in research on Microsoft 365 (Entra ID) security and had the chance to share our findings at both Czech and international conferences. We’ve made huge progress in this area — in fact, we’ve fully migrated to Entra ID and decommissioned our legacy on-prem AD.

If you’re looking to secure your own Microsoft 365 / Entra ID environment — or want to explore Dark Web Monitoring for your organization — feel free to reach out to my colleague: martin.melich@patron-it.cz

Stay safe out there.

Martin