goo.gl Domain Breach Exposure Report

The telemetry indicates a significant exposure event affecting 2,788 clients and 128 employees, primarily driven by 2,692 historical data breaches and 224 active infostealer logs. The exposure period spans from July 2025 to June 2026, with a notable surge in client-related events during March, April, and June 2026. Malware families such as Redline and LummaC2 are identified, targeting Windows operating systems, with "Combolist sources" being the predominant leak repository type. The domain "goo.gl" and its subdomains are frequently observed in targeted services, suggesting a potential compromise or misuse of URL shortening services. Given the high volume of data breaches and active infostealer activity, this event poses a critical risk. The prevalence of "Combolist sources" indicates credential stuffing or account takeover attempts are likely. Prioritization should focus on immediate remediation of compromised credentials, enhanced monitoring of client and employee accounts, and a thorough investigation into the root cause of the data breaches and infostealer infections. The identified malware families suggest a need for updated endpoint protection and user awareness training.