google.kz Domain Breach Exposure Report

The telemetry indicates a significant exposure of 276 historical data breaches and 90 active infostealer logs associated with google.kz. The majority of these events, 75.4%, are historical data breaches, with 24.6% being active infostealer logs. The timeline shows a notable increase in both employee and client-related events from September 2025 onwards, peaking in April 2026. Malware families such as Redline and LummaC2 are present, and the primary targeted services are related to google.kz login and API endpoints. The data originates predominantly from "Combolist sources" (98.2%) within leak repositories, suggesting credential stuffing or account takeover attempts. The high volume of historical data breaches and active infostealer logs, coupled with the targeting of login services, presents a substantial risk of account compromise and potential further data exfiltration. The prevalence of "Combolist sources" indicates that compromised credentials are being actively leveraged. Prioritization should focus on immediate credential hygiene, multi-factor authentication enforcement, and monitoring for anomalous login activity on google.kz and related services. The observed malware families, Redline and LummaC2, are known for stealing credentials and sensitive information, amplifying the risk.