Passguard Platform monitors criminal marketplaces to detect infostealer malware infections that compromise employee devices and steal session data. The platform identifies when infected devices with active sessions to organizational systems are listed for sale on underground marketplaces. The service operates with zero-touch setup, requiring only domain specification without access credentials. Organizations define domains to monitor, and Passguard scans marketplaces to identify compromised devices that have stolen authentication data for those domains. Detection results include device details (OS version, hostname, IP address, device username), session details (cookies, URLs, usernames, passwords, browser version), infection details (stealer family, subtype, malware path), and timeline context (infection timestamp, marketplace listing date). The platform organizes data into employee infections, user infections, and infection traces with global search functionality. Team collaboration features include labels, comments on alerts, and status tracking. The platform provides alerts when compromised sessions are detected, enabling security teams to revoke sessions before attackers exploit stolen credentials. Historical infection data from before signup is accessible for retrospective analysis.