Infostealer malware logs used to identify child abuse website members

Recorded Future's Insikt Group analyzed infostealer logs collected from February 2021 to February 2024 and identified 3,324 unique accounts that accessed known CSAM portals; by correlating stolen credentials, browser data, crypto transaction histories, IPs and other artifacts with OSINT, analysts linked those accounts to real-world identities and shared findings with law enforcement, demonstrating both the forensic value and the privacy/abuse risks of large stolen-credential datasets.