Caught in the Net: Using Infostealer Logs to Unmask CSAM Consumers

Recorded Future analyzed infostealer malware logs from Feb 2021–Feb 2024 to identify 3,324 unique credentials linked to known CSAM websites, showing that infostealer datasets can reveal CSAM consumers, surface new sources and trends, and aid investigations; findings were escalated to law enforcement and NGOs were engaged to expand source identification.