https://ashetrace.com/blog Field notes on infostealer exposure, session hijacking and defensible incident response, for the teams that have to contain it. en https://ashetrace.com/blog/how-to-check-computer-for-infostealer https://ashetrace.com/blog/how-to-check-computer-for-infostealer Check for an infostealer before you change any passwords. Flashpoint tracked 11.1 million infected devices in 2025. Here is a safe, ordered way to check. Incident Response Cassiano Assumpção Sat, 18 Jul 2026 12:00:00 GMT https://ashetrace.com/blog/can-hackers-bypass-two-factor-authentication https://ashetrace.com/blog/can-hackers-bypass-two-factor-authentication Yes, attackers can bypass 2FA by stealing the session after login. SpyCloud recaptured 17.3 billion stolen cookies in 2024. Here is how, and how to stay safe. Threat Intelligence Cassiano Assumpção Sat, 18 Jul 2026 12:00:00 GMT https://ashetrace.com/blog/signs-of-infostealer-infection https://ashetrace.com/blog/signs-of-infostealer-infection The signs of infostealer infection are often invisible: the malware runs once and exfiltrates in seconds. 80% of breaches now involve stolen credentials. Threat Intelligence Cassiano Assumpção Sat, 18 Jul 2026 12:00:00 GMT https://ashetrace.com/blog/passwords-keep-getting-leaked-after-changing https://ashetrace.com/blog/passwords-keep-getting-leaked-after-changing If your password keeps getting compromised after you change it, the cause was never removed. 40% of infostealer infections hit devices that ran antivirus. Incident Response Cassiano Assumpção Sat, 18 Jul 2026 12:00:00 GMT https://ashetrace.com/blog/password-appeared-in-data-leak https://ashetrace.com/blog/password-appeared-in-data-leak A Chrome or Apple alert that your password appeared in a data leak means it was found in a known breach corpus. SpyCloud recaptured 3.1B passwords in 2024. Threat Intelligence Cassiano Assumpção Sat, 18 Jul 2026 12:00:00 GMT https://ashetrace.com/blog/how-to-log-out-all-devices-after-password-leak https://ashetrace.com/blog/how-to-log-out-all-devices-after-password-leak After a leak, sign out of all devices to kill stolen sessions a reset leaves alive. Steps for Google, Microsoft, GitHub and AWS. 17.3B cookies stolen in 2024. Incident Response Cassiano Assumpção Sat, 18 Jul 2026 12:00:00 GMT https://ashetrace.com/blog/how-to-know-if-someone-logged-into-account https://ashetrace.com/blog/how-to-know-if-someone-logged-into-account Check your account's active-sessions list, then watch for forwarding rules and unknown OAuth apps. SpyCloud found 17.3B stolen session cookies in 2024. Threat Intelligence Cassiano Assumpção Sat, 18 Jul 2026 12:00:00 GMT https://ashetrace.com/blog/how-to-know-if-credentials-leaked https://ashetrace.com/blog/how-to-know-if-credentials-leaked How to know if your credentials were leaked, why a clean checker result is not proof, and the five exposure types tools miss. HIBP indexes 17.6B pwned accounts. Threat Intelligence Cassiano Assumpção Sat, 18 Jul 2026 12:00:00 GMT https://ashetrace.com/blog/how-to-know-if-browser-cookies-stolen https://ashetrace.com/blog/how-to-know-if-browser-cookies-stolen You rarely get an alert when browser cookies are stolen. SpyCloud recaptured 17.3 billion stolen session cookies in 2024. Here are the signs to watch. Threat Intelligence Cassiano Assumpção Sat, 18 Jul 2026 12:00:00 GMT https://ashetrace.com/blog/have-i-been-pwned-what-to-do https://ashetrace.com/blog/have-i-been-pwned-what-to-do Have I Been Pwned flagged your email? Here's what to do next: check what leaked, reset reused passwords, and revoke live sessions. HIBP tracks 17.6B accounts. Threat Intelligence Cassiano Assumpção Sat, 18 Jul 2026 12:00:00 GMT https://ashetrace.com/blog/email-in-data-breach-but-not-password https://ashetrace.com/blog/email-in-data-breach-but-not-password An email in a breach without your password is the lowest-risk exposure, not zero: 70% of breach victims reused a leaked password. What each case means. Threat Intelligence Cassiano Assumpção Sat, 18 Jul 2026 12:00:00 GMT https://ashetrace.com/blog/changed-password-after-breach-am-i-safe https://ashetrace.com/blog/changed-password-after-breach-am-i-safe Changed your password after a breach? You may still be exposed: stolen session cookies bypass the reset. SpyCloud recaptured ~17 billion stolen cookies in 2024. Incident Response Cassiano Assumpção Sat, 18 Jul 2026 12:00:00 GMT https://ashetrace.com/blog/can-hackers-access-account-without-password https://ashetrace.com/blog/can-hackers-access-account-without-password Yes. Attackers replay stolen session cookies, tokens and hijacked phone numbers to skip your password. SpyCloud recaptured 17.3B stolen cookies in 2024 alone. Threat Intelligence Cassiano Assumpção Sat, 18 Jul 2026 12:00:00 GMT https://ashetrace.com/blog/identity-exposure-management https://ashetrace.com/blog/identity-exposure-management Identity exposure management finds, revokes and rotates leaked credentials before attackers log in. SpyCloud recaptured 17.3B stolen session cookies in 2024. Threat Intelligence Cassiano Assumpção Sat, 18 Jul 2026 12:00:00 GMT https://ashetrace.com/blog/check-company-credentials-exposed https://ashetrace.com/blog/check-company-credentials-exposed A practical method for security teams to check for exposed company credentials across breach data and stealer logs. HIBP alone indexes 17.6B pwned accounts. Threat Intelligence Cassiano Assumpção Sat, 18 Jul 2026 12:00:00 GMT https://ashetrace.com/blog/dark-web-monitoring-vs-infostealer-monitoring https://ashetrace.com/blog/dark-web-monitoring-vs-infostealer-monitoring Dark web monitoring catches breach dumps and forum listings; infostealer monitoring surfaces fresh device logs and live cookies. SpyCloud logged 17.3B cookies. Threat Intelligence Cassiano Assumpção Sat, 18 Jul 2026 12:00:00 GMT https://ashetrace.com/blog/compromised-credential-monitoring https://ashetrace.com/blog/compromised-credential-monitoring Compromised credential monitoring finds users in breaches and stealer logs before attackers log in. Stolen credentials drove 22% of 2025 breaches (Verizon). Threat Intelligence Cassiano Assumpção Sat, 18 Jul 2026 12:00:00 GMT https://ashetrace.com/blog/password-reset-after-infostealer https://ashetrace.com/blog/password-reset-after-infostealer A password reset won't contain an infostealer: stolen session cookies stay valid until revoked. SpyCloud recaptured 17 billion malware-stolen cookies in 2024. Incident Response Cassiano Assumpção Sat, 18 Jul 2026 12:00:00 GMT https://ashetrace.com/blog/infostealer-incident-response https://ashetrace.com/blog/infostealer-incident-response Infostealer incident response checklist: isolate, revoke live sessions, rotate credentials, scope the blast radius. 276M 2025 creds carried active cookies. Incident Response Cassiano Assumpção Sat, 18 Jul 2026 12:00:00 GMT https://ashetrace.com/blog/employee-credentials-dark-web https://ashetrace.com/blog/employee-credentials-dark-web Employee credentials on the dark web signal a live compromise. Here is how to triage in hours: Verizon ties 22% of all breaches to stolen credentials. Threat Intelligence Cassiano Assumpção Sat, 18 Jul 2026 12:00:00 GMT https://ashetrace.com/blog/stolen-session-cookies-mfa-bypass https://ashetrace.com/blog/stolen-session-cookies-mfa-bypass Stolen session cookies let attackers replay an authenticated session and skip MFA. SpyCloud recaptured 17.3 billion of them from infected devices in 2024. Threat Intelligence Cassiano Assumpção Sat, 18 Jul 2026 12:00:00 GMT https://ashetrace.com/blog/stealer-logs-vs-data-breach-vs-combolists https://ashetrace.com/blog/stealer-logs-vs-data-breach-vs-combolists Stealer logs, data breaches and combolists are not one threat. Stealer logs are the freshest: 276M carried live session cookies in 2025 (Recorded Future). Threat Intelligence Cassiano Assumpção Sat, 18 Jul 2026 12:00:00 GMT https://ashetrace.com/blog/what-are-stealer-logs https://ashetrace.com/blog/what-are-stealer-logs A stealer log is everything an infostealer siphons from one infected device: passwords, cookies, tokens. Russian Market listed over 180,000 logs in H1 2025. Threat Intelligence Cassiano Assumpção Sat, 18 Jul 2026 12:00:00 GMT https://ashetrace.com/blog/what-is-infostealer-malware https://ashetrace.com/blog/what-is-infostealer-malware Infostealer malware harvests passwords, cookies and tokens from a device, then feeds corporate breaches. SpyCloud recaptured 17.3B stolen cookies in 2024. Threat Intelligence Cassiano Assumpção Fri, 17 Jul 2026 12:00:00 GMT