It’s the process of identifying usernames, passwords, and API keys that have been exposed on the dark web, often through data breaches, phishing campaigns, or code leaks. These credentials are traded, reused, and exploited by threat actors to infiltrate networks.