AI-native threat intelligence and risk operations for cyber, fraud and risk teams

Attackers scale with AI.
Now you can, too.

Most threat intelligence tools stop at the alert. Overwatch's AI agents keep going, investigating cyber and fraud threats and connecting evidence across sources until your team has a decision it can act on.

DetectionsRepresentative findings

Detections

Detected in monitored channels

Kestrelmoor Bank · last 60 days
PriorityDetectionChannelStageSeen

    Investigation

    Untitled · 10-06 09:41
    >Tell me about OTP and SMS fraud aimed at Kestrelmoor customers
    working · 1 callsworked 24.6s · 13 calls · 1 scan
    OTP and SMS fraud

    Code interception is sold as a live service: a bot calls the customer, poses as the bank and captures the one-time code while the buyer is logged in.

    # Duskwire OTP-CHAT1,214 msgs streams “live hits” that name Kestrelmoor among supported banks. # Ashwick Pay exchange860 msgs recruits “OTP work”: people who rent out bank accounts for a commission.

    Sellers and channels: OTP interceptionSource ↗
    Larkspire posts “OTP work” offers into 3 channels
    Confidence
    • High — OTP-interception bots and code panels are advertised across Telegram.
    • High — Duskwire OTP-CHAT names Kestrelmoor as a supported bank.
    • Medium — “OTP work” here means renting out bank accounts, not ordinary jobs.
    • Low — The sellers' claimed capture and success rates.
    Why low? Success claims come only from the sellers' own bot posts. No victim reports or independent confirmation found.
    ask

    Investigations

    Manage and track your security investigations

    Add Investigation
    Search investigations…

    9 investigations found

    Duskwire OTP bot naming Kestrelmoor
    Deep and Dark WebOngoing
    Oct 06, 2026Updated just now
    1 URL2 Files6 Messages

    An OTP-interception bot lists Kestrelmoor among supported banks, and a recruiter in three channels pays commission for bank-account access. Six messages attached as evidence.

    View Details
    New-device check bypass
    Fraud MethodsOngoing
    Sep 30, 2026Updated 1 day ago
    1 URL1 Event

    A Telegram post sells a method for getting past Kestrelmoor’s new-device checks. Agents are matching it against recent account takeover reports.

    View Details
    Staff logins in a stealer log
    Deep and Dark WebCompleted
    Sep 27, 2026Updated 6 days ago
    1 File

    Three corporate logins for Kestrelmoor staff found in an infostealer log. Each one was matched to a current employee account and sent to the security team.

    View Details
    Branch staff recruitment
    Deep and Dark WebOngoing
    Sep 24, 2026Updated 2 days ago
    1 URL1 Event

    A Telegram post offers payment to bank branch staff for customer lookups. Agents are tracking the poster across other channels.

    View Details
    Lookalike login domain
    DomainsCompleted
    Sep 21, 2026Updated 13 days ago
    1 URL2 Files

    kestrelmoor-verify.example served a copy of the online banking login page. The evidence package went to the brand team for takedown.

    View Details
    Payroll vendor data leak
    3rd PartiesOngoing
    Sep 17, 2026Updated 4 days ago
    2 URLs1 File

    A ransomware group posted data it says came from a payroll vendor Kestrelmoor uses. Agents are checking the sample for employee records.

    View Details
    Executive exposure review
    VIP ProtectionCompleted
    Sep 15, 2026Updated 18 days ago
    4 Files

    Exposure review for five Kestrelmoor executives: home addresses on data broker sites, two impersonation accounts and public travel mentions.

    View Details
    Banking logins in a combo list
    Breaches / Data LeaksCompleted
    Sep 05, 2026Updated 27 days ago
    1 File

    Thirty-eight Kestrelmoor online banking logins posted to a paste site. Most pairs match an older breach; six are new.

    View Details
    Account mule recruitment
    Fraud SocialCompleted
    Aug 27, 2026Updated about 1 month ago
    1 URL

    Social posts offer cash to Kestrelmoor customers who rent out their accounts. Four posts trace back to the same recruiter.

    View Details
    Search Kestrelmoor Bank Deep and Dark Web…
    24h7d30d
    Filters:Event Status: ACTIVEORCOMPLETED
    Showing 6 of 6 detectionsSelect All
    Sale Of Methods Targeting YouP0
    Method: OTP bot naming Kestrelmoor
    FieldValue
    TypeOTP bot
    ChannelDuskwire OTP-CHAT
    SenderDuskwire v4
    Channel Id duskwireotpMentions Kestrelmoor
    t.me/duskwireotp2 days ago
    ACTIVEFO
    1 article
    Sale Of Methods Targeting YouP0
    Method: “OTP work” recruitment
    FieldValue
    TypeRecruitment
    ChannelAshwick Pay exchange
    SenderLarkspire
    Channel Id ashwickpayMentions Kestrelmoor
    t.me/duskwireotp2 days ago
    ACTIVE
    1 article
    Sale Of Methods Targeting YouP0
    Method: OTP bot price list
    FieldValue
    TypeOTP bot
    ChannelGreywick Exchange
    SenderLarkspire
    Channel Id greywickxMentions Kestrelmoor
    t.me/duskwireotp2 days ago
    ACTIVE
    1 article
    Method: OTP bot naming Kestrelmoor
    TypeOTP-interception bot
    ChannelDuskwire OTP-CHAT
    SenderDuskwire v4
    Banks namedKestrelmoor Bank and 11 others
    Claimed methodAutomated call that asks for the code
    Pricing1 week $60 · 1 month $150
    First Seen2026-10-04
    Messages1,214
    SourceTelegram
    Comments:
    Comment
    FO
    Fraud Opsjust now

    Step-up checks on for new-device logins. SMS warning queued to customers.

    Routed to fraud ops · CriticalCase management · SIEM · Email alert
    1. Detect

      Signal collection at scale

      Continuous collection across the criminal underground, markets, leak sites, forums and channels where fraudsters and threat actors stage. Classifiers and anomaly detection turn a constant stream of raw activity into candidate signal.

    2. Investigate

      Agentic investigation

      AI agents traverse threat actor networks, verify exploits, follow checkout flows, and assemble evidence packages, without waiting on an analyst to start.

    3. Act

      Analyst-validated delivery

      Validated findings delivered into your stack: SIEM, SOAR, case management, executive briefings. Analysts answer the hard questions and find the leads the platform then watches for.

    Customers and partners

    Used by Visa and 40+ other leaders in finance, fintech and media.

    • Visa
    • Orlando Magic
    • FS-ISAC
    • ICBA
    • NCFTA
    • TRM Labs
    • SCOOP Cyber

    Backed by

    • Mouro Capital
    • Visa Ventures
    • Capital One Ventures
    • New Era Capital Partners
    • Pruven Capital
    • Y Combinator

    Platform

    Attack volumes are compounding. Analyst hours are not.

    AI dropped the cost of running a scam to nearly zero, and threats arrive from every direction: compromised accounts, fraud patterns, fake merchant applications. Overwatch covers them all on one system, taking each from signal to decision. AI agents build the evidence, our analysts handle the cases that need human judgment, and your team acts in Overwatch or the tools you already use.

    Platform overview

    Human in the loop with expert support

    Our analysts work where stolen data and access are sold.

    Each case starts as a fragment, a receipt, a post, a record, and gets pulled until it resolves. The most challenging are investigated further by our analysts.

    Documented findingCase 01

    Payout programs

    About 150 buyer receipts with no card numbers became an active attack on a national delivery platform's payout program: 6,439 cards listed on day one, 16,306 by day three. Platform notified in-window.

    Confirmed

    • 46 cards in hand
    • One issuer across every receipt
    • Two BINs, listings ongoing
    • Balances still available
    • Fraud transactions occurred
    • Root cause
    Documented findingCase 02

    Card manufacturing

    Stolen cards from several banks, all mailed to one state, became a possible insider at a third-party card manufacturer. Affected banks alerted.

    Confirmed

    • Cards from at least three issuing banks
    • Single mailing address
    • Number of affected cardholders
    • Manufacturer's role, insider vs. compromised system
    Documented findingCase 03

    Banking

    A pinned post claiming an insider at a major bank became a documented allegation in the bank's hands before anyone else had seen it, marked as unvalidated.

    Confirmed

    • Post predates any public disclosure
    • Named individual holds the role claimed
    • Insider access, still allegation
    • Extent of data exposure
    Documented findingCase 04

    Identity data

    One sample record from a marketplace claiming 170 million identities became a single identity-verification vendor, later confirmed by independent reporting and a federal inquiry.

    Confirmed

    • Sample record matched to named vendor
    • Independent reporting and a federal inquiry followed
    • Full scope of the 170 million figure

    Built for the threat escalations that can't wait.

    When a fraud team makes a decision, real money moves. When a SOC escalates, hours of investigation follow. Overwatch is built to make sure that time isn't wasted, catching what your existing stack misses and turning it into a case worth escalating. This is operational threat intelligence: the shift from reactive triage to proactive, scalable risk operations.

    When one bank’s fraud and cyber intelligence team switched to Overwatch, here’s what changed:

    6×
    more critical threats resolved
    3 days
    earlier detection of emerging threats
    20+
    analyst hours back each week

    Results from one Overwatch customer’s first 90 days, compared with its previous tools and processes.

    “Overwatch has surfaced more digital threats in 90 days than my entire 7 years at two previous major banks combined.”
    SVP, Fraud & Cyber Intelligence, Major Regional Bank

    Frequently asked

    Questions risk leaders ask us.

    What is AI-native threat intelligence and risk operations?

    AI-native threat intelligence and risk operations is a way of running fraud, cyber, brand and merchant risk reviews on one system, with AI agents and expert analysts doing the collection, investigation and first-pass assessment that teams used to do by hand. Overwatch Data built its AI threat intelligence platform on this model. What Overwatch learns about how attackers operate feeds straight into monitoring, investigations, onboarding reviews and risk decisions to combat digital threats.

    What is operational threat intelligence?

    Operational threat intelligence is threat intelligence that ends in action and can be pulled into everyday risk operations and reviews. Classic intelligence tiers use “operational” for insight into specific campaigns and actors. Overwatch uses the term more literally: intelligence that runs the investigation, reaches an assessment and lands in the workflow where a fraud, security or onboarding team makes its call. It reflects a wider shift in the market, as threat intelligence becomes risk operations infrastructure.

    Why now

    How is Overwatch different from a threat intelligence platform (TIP) or a data feed?

    Overwatch goes further than threat intelligence. Most intelligence products deliver data and alerts, then leave the investigation and the decision to a human queue. Overwatch does that work. As an agentic threat intelligence platform, it collects adversarial intelligence from the criminal underground, uses AI agents and expert analysts to investigate it, and routes a defensible result into the systems where your team acts. Validated findings arrive with their evidence, a severity rating and a recommended action.

    Stop chasing alerts. Start working ahead of them.

    Overwatch turns real-time understanding of the criminal underground into the investigations and risk decisions your fraud and security teams have to make every day.