Dark Web Malware Logs Expose 3,300 Users Linked to Child Abuse Sites

Recorded Future's Insikt Group analyzed dark web stealer logs and identified 3,324 unique credentials used to access known CSAM domains between February 2021 and February 2024, noting that off-the-shelf info-stealer malware (e.g., Kematian, Neptune, Poseidon, Satanstealer) is widespread and commonly distributed via phishing, cracked software, fake updates, SEO poisoning, and malvertising; the report highlights how stolen credentials and cryptocurrency wallet addresses can help law enforcement trace child exploitation and other criminal activity.