Back

mastec.com Domain Breach Exposure Report

Risk Score

High Risk

Critical asset booster applied - enterprise VPN / gateway credentials exposed.

AI Findings Summary

Critical

The telemetry indicates a significant exposure of employee and client data, with over 9,000 historical data breaches and 465 active infostealer logs observed. The data breaches represent 95.2% of the total events, while infostealer logs account for 4.8%. The timeline shows a substantial spike in employee-related events in January 2026, with over 4,000 occurrences, and a notable increase in client-related events in September 2025. Malware analysis reveals Redline as the most prevalent infostealer family, followed by StealC and Rhadamanthys. Targeted services include various login portals for mastec.com, particularly those related to gatekeeper.mastec.com and Okta authentication, suggesting potential credential compromise. The majority of observed data originates from combolist sources and database dumps, with a concentration of affected systems in the United States.

Total Events

9,694
credential exposure events

Employee Affected Events

7,616
account email domain = mastec.com

Client Affected Events

2,078
service target = mastec.com

Free Community Account

Stop stolen credentials from logging in

Own this domain? Create a free Lunar account to see full exposure data and evidence.

12-Month Events Timeline

Event volume by breach date, employee VS client

EmployeesClients
5,0003,3331,6670
peak month 4,352
Jul 25Sep 25Nov 25Jan 26Mar 26May 26Jun 26

Infostealers VS Data Breaches

Live stealer logs VS data breaches

Infostealer logs
Events465
Share5%
Data breaches
Events9,229
Share95%
Infostealer logs (5%)
465events
Data breaches (95%)
9,229events

7,616 compromised employee accounts pose an infrastructure risk, while 2,078 leaked client credentials create regulatory liability.

Antivirus Distribution

Security Tools on Infected Endpoints

No Data Available

Malware Families Distribution

Distribution of Active Stealer Strains

Redline151
StealC73
Rhadamanthys61
Vidar31
LummaC223
RisePro19
X-Files10
Acreed7

Top Login URLs

Top exposed services found in the event results

  1. 1mastec.com263
  2. 2https://wl.mastec.com/CookieAuth.dll135
  3. 3https://gatekeeper.mastec.com/AM/TP/Login.aspx124
  4. 4gatekeeper.mastec.com99
  5. 5gatekeeper.mastec.com/AM/TP/Login.aspx96
  6. 6https://gatekeeper.mastec.com93
  7. 7https://asbaaa.mastec.com/vpn/tmindex.html81
  8. 8gatekeeper.mastec.com/am/tp/login.aspx75
  9. 9https://gatekeeper.mastec.com/am/tp/login.aspx58
  10. 10https://login.mastec.com/signin/verify/okta/password39

Infostealer By Geography

Shows the distribution of Infostealer-related credential exposure events across different geographic regions. The location is determined by analyzing the metadata of the infected machines associated with each event.

United States
Events328
Philippines
Events20
Japan
Events6
Venezuela
Events2
Brazil
Events1
Mexico
Events1

Country Breakdown

  1. 1United States328
  2. 2Philippines20
  3. 3Japan6
  4. 4Dominican Republic4
  5. 5Venezuela2
  6. 6Brazil1
  7. 7Mexico1

Services Classification Distribution

Blast radius - closer to core = more critical infrastructure, size = credential volume

Microsoft204
Citrix93
Okta39
WordPress8

Operating System Distribution

Distribution of compromised endpoint builds

Windows 10 Pro96
Windows 10 22H2 build 19045 (64 Bit)74
Windows 10 Pro x6472
Windows 10 Pro [x64]37
Windows 10 Enterprise x6435

Leak Repository Classification

Where the exposed records currently reside

0
Named breaches
3,331
Combolist pools
5,898
Unattributed dumps

Disclaimer: This report includes AI-generated content. AI can make mistakes, so verify important findings independently before taking action.