Active-compromise signal
Stealer-log hits mean a device was infected and credentials exfiltrated — not just an old breach. This is the exposure that gets companies breached today.
Data source · Infostealer logs
Hudson Rock Cavalier.
Correlated. One report.
Hudson Rock's Cavalier dataset is built from infostealer malware logs collected across the cybercrime ecosystem — the single highest-signal source of active credential compromise.
About the source
What is Cavalier?
Infostealers like RedLine, Lumma, StealC, Raccoon, and Vidar silently harvest saved passwords, cookies, and session tokens from infected machines and sell them on dark-web markets. Because these captures include live session data, they frequently bypass MFA. darkweb-scanner queries Cavalier by domain to surface compromised employees, users, and third-party services, with the stealer family and capture recency for each.
- Maintainer
- Hudson Rock
- Coverage
- Domain, employee & user infostealer exposure
- License
- Hudson Rock API (community / free tier)
- Source
- hudsonrock.com ↗
Capabilities
What Cavalier covers
The source's scope — we query it against your domain and report the exposures we find.
Domain-wide coverage
One query returns every compromised employee and user tied to your domain, not just a single email.
Session & cookie awareness
Captures often include live session cookies that bypass MFA — flagged so you know a reset alone may not be enough.
Stealer family & recency
Each finding carries the malware family and how recently the capture was seen, so you can prioritize.
Surface area
Where it looks
Employee credentialsUser credentialsSession tokensThird-party exposure
Use cases
When it earns its keep
Incident triage
Confirm whether an employee's machine was infected and what credentials and sessions were exposed.
Continuous monitoring
Re-scan on a schedule to catch new infostealer captures as they appear on dark-web markets.
Client reporting for MSPs
Hand each client a clear list of compromised accounts with remediation — reset, revoke sessions, clean the device.
Other data sources
Add another source
Shodan
External attack-surface intelligence — subdomains, exposed services and open ports, and known CVEs on internet-facing hosts tied to a domain.
theHarvester
Open-source OSINT collection — emails, subdomains, and hosts gathered from dozens of keyless public sources, plus the Hudson Rock breach module.
Maigret
Maps usernames and handles tied to a domain's people across 4,000+ sites — the public identity footprint attackers use for targeting.
One credit. One domain. One report.
Run Cavalier against a domain and get a severity-ranked exposure PDF. Credits never expire.