A practitioner’s roadmap to the OSINT tools that actually earn their place in your bookmarks bar. Free and paid, with honest notes on what each one is good for.
Browsing: Uncategorized
Once an infostealer has executed, every credential on the device is gone. Detection has to come before that, or detection is too late. A practical guide to catching infostealer infections at the host, network, and identity layer.
Telegram has become the dominant marketplace for stealer-log distribution. Channels with hundreds of thousands of subscribers drop fresh logs continuously, with payment processed in cryptocurrency and a tiered access model that mirrors the SaaS industry. Here is how that economy works.
Multi-factor authentication protects the moment a user logs in. It does nothing once they are authenticated. Modern infostealers steal the resulting session cookie and replay it from anywhere, bypassing MFA entirely. Here is how the attack works and what actually defends against it.
A dollar-per-log credential-theft economy now feeds the multi-million-dollar ransomware economy. The pipeline from a teenager’s pirated game download to enterprise extortion is shorter than most security teams realise.
A handful of malware-as-a-service operations supply the bulk of the world’s stealer logs. Knowing which families are active, what they steal, and how they have changed in response to law-enforcement pressure is foundational threat-intelligence work.
Infostealer malware quietly extracts saved passwords, session cookies, and crypto wallets from infected machines, packages them into “logs”, and sells them on Telegram for a few dollars. Here is what those logs actually contain, who buys them, and why they have become the dominant precursor to modern breaches.
Bellingcat has, more than any other organisation, defined what serious open-source investigation looks like in practice. The MH17, Skripal, and Russian-spy investigations are landmark cases. Here is the methodology they developed and how it can be applied.
Social-media OSINT was easier in 2018 than it is in 2026. Twitter’s API restrictions, Meta’s hardening, and the migration of communities to Telegram and Discord have reshaped what is possible. Here is the current state of the art across the major platforms.
Shodan, Censys, ZoomEye, FOFA, BinaryEdge, and a small set of others continuously scan every public IP on the internet and index what they find. They are essential tools for security research, attack-surface management, and OSINT. Here is the comparison.