iqiyi.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event affecting approximately 119,286 clients and 91 employees of iqiyi.com. The primary drivers of this exposure are historical data breaches, accounting for 77.6% of events, and active infostealer logs, representing 22.4%. The timeline shows a notable increase in client-related events from September 2025 onwards, peaking in March and April 2026, with employee-related events also appearing during this period. The data breaches appear to originate from "Combolist sources," while infostealer activity is dominated by malware families such as Rhadamanthys, Redline, and LummaC2, targeting services related to iqiyi.com's login and platform access, primarily in China and Taiwan. Given the high volume of client data breaches and active infostealer activity, this situation presents a critical risk. The prevalence of infostealer malware targeting login credentials suggests a high likelihood of account compromise and potential financial or identity fraud for affected individuals. Remediation efforts should focus on immediate incident response to contain the infostealer activity, including network monitoring, endpoint security enhancements, and credential reset campaigns for both employees and clients. Furthermore, a thorough investigation into the "Combolist sources" is crucial to understand the root cause of the historical data breaches and prevent future occurrences.