google.pt Domain Breach Exposure Report

The domain google.pt has experienced a high volume of data breach events, totaling 1271 incidents, which constitute 87.7% of all observed events. Additionally, 178 instances of infostealer activity were detected, representing 12.3% of the total. The timeline indicates a significant spike in client-related events during March 2026, with 350 occurrences, and a notable increase in employee-related events in April 2026, with 50 occurrences. Malware families associated with these events include LummaC2 (20.2%) and Redline (19.7%), both known for credential harvesting. The majority of data exposures originate from combolist sources (98.4%), suggesting compromised credentials are a primary vector. The affected operating systems are predominantly Windows 11 and Windows 10 variants, indicating a broad impact across user endpoints. Given the high number of data breaches and the prevalence of infostealer malware targeting credentials, this exposure presents a critical risk. The focus should be on immediate remediation of compromised accounts, strengthening authentication mechanisms, and enhancing endpoint security to detect and prevent further infostealer infections. The concentration of events on google.pt and its subdomains, along with the use of combolists, points to a potential large-scale credential stuffing or account takeover campaign impacting both employees and clients.