Browser
Step-by-step workflow guide for investigators
Organizational Risk Assessment
Starting from a single domain, this guide walks you through establishing what an organisation is already exposing — employee credentials circulating in infostealer logs, the full scope of what a compromised device gave up, and the identities behind the records. Run it against your own domain to find where staff data has leaked and what operational risk that creates, or against a prospective partner or supplier to establish whether their exposure would become your supply chain problem.
Who is this for?
Security and threat intelligence teams, third-party risk and procurement functions, and risk consultants assessing organisational exposure. There are two distinct triggers for this workflow, and they lead to the same steps with different reporting:
Assessing your own organisation — establishing whether employee credentials and personal data have leaked, which devices are compromised, and what operational risk that creates. The output drives remediation: forced resets, endpoint investigation, and staff notification.
Assessing another organisation — establishing, before entering into a relationship, whether a prospective partner, supplier, or acquisition target carries exposure that would reach you. The output drives a decision: proceed, proceed with conditions, or decline.
Assessing your own organisation — establishing whether employee credentials and personal data have leaked, which devices are compromised, and what operational risk that creates. The output drives remediation: forced resets, endpoint investigation, and staff notification.
Assessing another organisation — establishing, before entering into a relationship, whether a prospective partner, supplier, or acquisition target carries exposure that would reach you. The output drives a decision: proceed, proceed with conditions, or decline.
What is on this page?
A step-by-step guide for using Maltego Graph (Browser) to assess an organisation's existing exposure from its domain alone. The workflow covers searching infostealer logs for stolen employee credentials, extracting the identities and target services behind those records, drilling into a single infected endpoint to establish the full scope of one compromise, pivoting to the individual affected, and checking the domain against broader dark web leak records.
How to use this page?
Watch the video at the top for an end-to-end overview, then follow the written steps below to conduct an investigation using your own domain.
New to Graph?
No problem. Every platform feature mentioned in this guide links to the relevant product documentation so you can read up as you go.
A note on results
The steps here reflect what works for most customers in this use case. Because Graph (Browser) works with live data, results depend on what is actually available at the time you run Transforms. Maltego cannot guarantee the same outcome for every case.
Before you start:
Identify the starting point
Domain you are trying to investigate.
Access
- Open Maltego Graph (Browser) from app.maltego.com .
Note that you need a Maltego ID to log in. - Make sure your plan includes access to the product (not included for Basic plan users).
- Check if your Organization Admin enabled access to the Data Pass and stealer logs within.
Note: Stealer log data is restricted to Enterprise plans. Basic users have limited access to the data providers used in this workflow more generally — some Transforms may be unavailable or return restricted results depending on your plan tier.
Resources
This guide assumes basic familiarity with Graph (Browser). Feature names link to the documentation where needed. It helps to have the following pages open before you start:
Video Overview
Watch an organizational risk assessment workflow demonstration. Then follow the step-by-step guide below to build your own, or skip the video and jump straight to the steps.
To enlarge, double-click on the video.
Step-by-Step Guide
Step 1: Search stealer logs for stolen credentials
Infostealer malware harvests saved credentials from infected machines, and those logs circulate in underground markets. This search asks whether any of them contain logins tied to the organization's domain.
How to:
How to:
- Add the Domain Entity to the graph.
- Open the Transform menu by right-clicking on the Entity.
- Navigate to Search in Stealer Logs. This Transform looks for stolen records where a login or username contains your domain as an email address.
- Select all or some returned Stealer Credential Entities and run Expand Stolen Credential Transform. You will get the specific stolen credentials and a compromised host.
Note on access
Please note that stealer logs are only accessible to Enterprise plan users. If you do not see the Transforms mentioned above in your Transform Menu, you might be on a different plan. In that case, jump to Step 3.
Please note that stealer logs are only accessible to Enterprise plan users. If you do not see the Transforms mentioned above in your Transform Menu, you might be on a different plan. In that case, jump to Step 3.
Stealer logs disclaimer
The search queries data that has already been stolen or breached and is already circulating in underground markets. Nothing is being accessed, compromised, or exfiltrated by running it.
The search queries data that has already been stolen or breached and is already circulating in underground markets. Nothing is being accessed, compromised, or exfiltrated by running it.
What you can find
Once the Transform runs, the graph will populate with the following (depending on what has been stolen):
- The employee's name, attached to the corporate email address in the record.
- The password captured alongside it — check whether it would still work, and whether its pattern suggests others in use.
- The originating IP address of the infected endpoint.
- The service the credentials were used against.
Step 2: Explore a specific endpoint
Step 1 told you what was stolen relating to the domain. This step asks a bigger question of one record: what else did that same infected device give up?
After you expand the stealer credentials, the graph will populate it with Compromised Host Entity. Select the Entity and run Get Stolen Credentials.
Graph will return everything harvested from that specific device that might include:
After you expand the stealer credentials, the graph will populate it with Compromised Host Entity. Select the Entity and run Get Stolen Credentials.
Graph will return everything harvested from that specific device that might include:
- social media handles
- personal email addresses
- physical addresses
- phone numbers
- browsing and search history
- financial or banking details.
Step 3: Look for breach data against the domain
An independent line of enquiry from the same starting point. Where Steps 1 and 2 went deep on individual compromised devices, this measures breadth — how widely the organization's addresses appear across leaked datasets.
How to:
What you can find
Leak records referencing the domain, typically surfacing a long list of exposed email addresses, phone numbers, names, and locations.
How to:
- Open the Transform menu by right-clicking on the Domain Entity.
- Run Comprehensive Search → Search Domain.
What you can find
Leak records referencing the domain, typically surfacing a long list of exposed email addresses, phone numbers, names, and locations.
When to stop?
Exposure assessment has no natural end point — underground data keeps accumulating, and every infected endpoint can be followed further. What marks completion is having enough to support the decision the assessment exists to inform: what to remediate, or whether to proceed.
What's next?
-
Map the online presence of an alias identity.
-
Set up a Threat Actor monitor for tracking the person's social media feed for threatening posts.
-
Investigate the threat actor on Telegram
Other guides you might find useful:
Give us your Feedback!
Copyright © 2026
What is Maltego?
Write your awesome label here.