masco.com Domain Breach Exposure Report

The telemetry indicates a significant exposure of employee credentials, with 38,131 employee events and 36,949 historical data breaches observed over the reporting period. The majority of these breaches (95.6%) are categorized as historical data breaches, with a substantial portion (90.2%) originating from combolist sources. Active infostealer logs account for 4.4% of events, with Redline malware being the predominant family (98.6%). The exposure appears to be concentrated around the "sts.masco.com" service, particularly its authentication endpoints, and involves a variety of Windows operating systems. Geographically, the Netherlands, United States, and Germany show the highest number of associated events. Given the high volume of historical data breaches and active infostealer activity, this situation presents a critical risk of account compromise and further data exfiltration. The prevalence of Redline malware suggests a targeted campaign likely aimed at harvesting credentials. Prioritization should focus on immediate credential reset for all affected employees, enhanced monitoring of "sts.masco.com" and related authentication services for suspicious activity, and a comprehensive review of access controls and security configurations for these systems. Investigating the root cause of the combolist exposures and implementing measures to prevent future credential stuffing attacks is also paramount.