Fuente: Noticias ICEX Lugar: Threat Intelligence Threat IntelligenceCredential Leak Dark Web Agent: Monitor exposed accounts Monitor your email domains, filter leaked credentials, and give IAM and the SOC exposed accounts and source context to investigate and remediate.Chris Pickardon Oct 27, 2026BLUFThe Credential Leak Dark Web Agent lets you monitor corporate email domains across dark web forums and marketplaces, Telegram and Discord channels, and data leaks. Assess which new findings require action and give your security team the context they need to investigate and remediate.Catch exposed accounts other tools may miss, and spend less time sifting through leak data or rechecking recycled credentials you’ve already seen.Start free trialHow does the Credential Leak Dark Web Agent work?The agent matches your email domains against dark web leak data it collects. It summarizes each matching leak and organizes the affected credentials, source excerpts, and related intelligence for review.Here’s how the parts fit together:Monitor your email domains, assess matching leaks with source context, and share relevant findings with your security teamDark web sources. The agent searches the full collection of sources behind Feedly’s Dark Web Agents. It covers Tor, I2P, ZeroNet, OpenNIC, public and private Telegram channels, Discord, IRC, and FTP, plus data leaks and forums outside these networks. As of September 2026, the collection included about 81 active darknet marketplaces, 5,000 Telegram channels, 260 Discord servers, and 1,710 named data leaks. Continuously adding new sources and leaks.The agent. Enter up to five email domains per agent, including domains from subsidiaries and acquisitions. The agent checks for new matches every 24 hours.Findings. Each matching leak appears as one row in the findings table. Feedly AI summarizes each leak in the What/So what column. Filter by domain, leak type, password presence, email address, and password requirements.Credential Leaks Insights Cards. Open a finding to see the matching email addresses and any passwords, a source excerpt, and whether each combination is New or Recycled for this agent. When Feedly links the leak to a known threat actor or reported cyberattack, the card links to the related Threat Actor Insights Cards and Cyberattack Insights Cards.Trends & visualizations. View this tab to see how findings change over time, their sources, and which accounts are most exposed.Sharing. Include findings in Automated Newsletters, export a card’s credential table, or retrieve findings through the API.We were actually finding things in Feedly that we couldn't find in other tools, even in our current dark web monitoring tool.CTI analyst global sportswear companyUsing the Credential Leaks Dark Web Agent in your workflow: an energy company exampleFabrikam Energy is a fictional regional utilities company that acquired Litware, whose employees still use the domain litware.example. As a member of its CTI team, you monitor leaks that match your domains and password policy, assess which findings matter, and share them with the Identity and Access Management (IAM) team and the SOC. The findings below are illustrative.Monitor leaks that match your domains and password policyCreate a Credential Leak Dark Web Agent for fabrikam.example and litware.example. Matching leaks for both domains appear in the findings table.Monitor email domains from your organization, subsidiaries, and acquisitions in one Credential Leak Dark Web Agent.Set password requirements to Fabrikam’s policy. The findings table then hides leaks where no password meets the policy, since those passwords can’t be current.Apply your password policy to hide leaks where no password meets your requirements.The password complexity filter is super, super helpful for pulling out a lot of noise.CTI Analyst major US universityReview findings with What/So what summariesEvery 24 hours, the agent checks its sources for new leaks that match your domains. Each matching leak becomes a row in the findings table, with a What/So what summary from Feedly AI explaining what the leak contains and why it may matter.Feedly AI’s What/So what summaries explain what each leak contains and why it may matter.Assess which findings need action with Credential Leaks Insights CardsOpen a finding to decide whether it needs action.The Credential Leaks Insights Card includes a leak summary, timeline details, and a list of affected employee accounts. The First seen and Status fields show whether each email-and-password combination is new or recycled for this agent.Review exposed accounts, available passwords, and source context to decide which findings need action.When Feedly associates a leak with a known threat actor or reported cyberattack, the Insights Card includes links to the associated Threat Actor Insights Cards and Cyberattack Insights Cards so you can quickly pivot and understand the broader picture.Explore a linked Threat Actor Insights Card to understand the actor associated with a leak.For a recycled email-and-password combination, click the First seen date to review the earlier finding and compare it with your investigation records. If you've already investigated the combination and the new finding adds no relevant context, you don't need to ask IAM to check it again.Based on the findings in the Credential Leak Dark Web Agent, I have enough information to take action.Olav Ormestøyl CTI Team Lead Sopra SteriaShare findings with IAM and the SOCExport the credential table from the Insights Card and attach it to your IAM request so they can validate the affected accounts and reset passwords that still work.Send the affected accounts with source context to your SOC so they can confirm whether the infection came from a company device, check sign-in logs for misuse, and revoke active sessions.Include findings in Automated Newsletters, or pull them into your TIP, SOAR, or other security tools through the Feedly API, to keep IAM, the SOC, and other stakeholders informed of new leaks.Track credential leak trendsSwitch to the Trends & Visualizations tab to see how Fabrikam’s matching leaks change over time, where they appear, and which employee accounts appear most often. Use these patterns to focus follow-up with IAM and give stakeholders a clear picture of observed credential exposure.Track credential leak trends and identify the sources and employee accounts that appear most often.What makes the Feedly Threat Intelligence approach different?Password filtering. Apply your organization’s password requirements to hide leaks where no password meets the policy.Recycled credentials. Check earlier observations against your investigation records before asking IAM to review the same credentials again.Threat context. Feedly AI summarizes each leak. When Feedly identifies an association, Credential Leaks Insight Cards link to related threat actors and cyberattacks.Unified workspace. Review credential leak findings alongside your threat intelligence feeds, vulnerability tracking, and cyberattack coverage in Feedly.Get started with Credential LeaksOnce the Dark Web add-on is enabled for your account, create a Credential Leak Dark Web Agent for your corporate email domains. Use your first credential leak finding to review affected accounts and share relevant findings with your security team.Start free trialFAQsWhere does the data come from?Credential Leaks searches the full collection behind Feedly’s Dark Web Agents. The collection includes:Networks: Tor, I2P, ZeroNet, OpenNIC, Telegram, Discord, IRC, and FTP.Sites and content: data leaks and credential dumps, ransomware leak sites, public and authenticated forums, marketplaces, paste and dox sites, and imageboards.Gated content: private Telegram channels and forums behind a login.How often does the agent refresh, and how much history will I see?Feedly checks for new matches every 24 hours. The time between the original exposure and its appearance in Feedly also depends on source collection and indexing. Setup retrieves a limited snapshot of matching leaks, with ongoing monitoring adding new matches.Are subdomains included automatically?No. Enter each relevant email domain or subdomain you want to monitor explicitly. Each agent supports up to five specified domains. The domain can not include a wildcard.How many agents are included in the Dark Web add-on?Five agents. Each agent can monitor up to five email domains.Does the agent validate passwords or reset accounts?No. Your IAM team validates accounts and determines the response using its existing systems and processes. The agent doesn't provide a dedicated integration with Microsoft Entra ID for validation.How can I export or automate credential leak findings?Password inclusion depends on the delivery method:MethodWhat it deliversPasswords included?Automated NewslettersShared findingsNoFindings table CSVList of leaksNoInsights Card credential table CSVCredentials from one findingYes, if present in the findingsFeedly APIFindings and Insights Card contentYes, if present in the findingsWho can view credential leak findings and passwords?Anyone on your Feedly team account can view credential leak findings, including passwords. Per-user restrictions aren't currently available for this data.How can I export or automate credential leak findings?Password inclusion depends on the delivery method:The findings table CSV does not consolidate affected accounts across all findings.This release doesn't include native alerting or on-demand dark web searches.Can I use Credential Leak Dark Web Agents for third-party risk monitoring?Yes. Monitor your corporate email domains to find employee accounts that appear in collected leaks involving a supplier or SaaS provider. Your third-party risk team can use the affected accounts and source context to assess your organization’s exposure, follow up with the supplier, and coordinate a response with IAM and the SOC. When available, related Cyberattack Insights Cards provide additional context about the incident.