Dark Web Exposure for clix.capital

Findings summary

Records for clix.capital show moderate exposure across dark web stealer logs and breach data, with 328 leaked credentials and 220 compromised devices recovered to date. Volume is falling — the last 90 days are down 40% on the preceding quarter, so much of this exposure is likely historical. The most recent record dates from 31 days ago.

Almost all of this is customer rather than staff exposure. 280 stolen logins for clix.capital services carry regulatory and reputational risk, alongside 48 employee credentials. Staff credentials were captured against Zoho and Microsoft 365, so the blast radius extends into third-party services outside the corporate perimeter.

Credential-stealing malware was found on 220 devices linked to clix.capital; the RedLine family account for the identified strains.

47% of recovered passwords reuse a top-10 pattern, so credential stuffing against adjacent services should be assumed. 2,792 session cookies were recovered from those same machines, most commonly for google.com and youtube.com. A stolen session cookie lets an attacker resume an already-authenticated session without the password or a second factor, and stays usable until the session is invalidated server-side — a password reset alone does not revoke it. Those same devices gave up 3 application tokens.