xtube.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting 104,801 clients and 334 employees, primarily driven by historical data breaches (89.7%) and active infostealer logs (10.3%). The data breach activity peaked in March 2026, with infostealer activity showing a more distributed pattern throughout the reporting period. The most prevalent malware families associated with this event are Redline and LummaC2, both known for credential theft. The primary target appears to be the "xtube.com" domain and its subdomains, with the United States being the most frequently observed geography. The data originates from combolist sources, suggesting compromised credentials were leaked. Given the high volume of client data breaches and the prevalence of infostealer activity targeting credentials, this event poses a critical risk. The focus for remediation should be on credential hygiene, including mandatory password resets for all affected employees and clients, enabling multi-factor authentication, and implementing robust monitoring for suspicious login activity. Further investigation into the root cause of the data breaches and the specific infostealer campaigns is recommended to prevent future occurrences.