Lunar Cyber has introduced Token Exposure Monitoring, a capability for finding, attributing and validating machine credentials exposed in infostealer logs.
The product focuses on non-human identities such as API keys, OAuth tokens and personal access tokens used in developer tools, cloud platforms and AI services. Lunar said it analyzes surrounding infostealer data to associate a token with the affected employee or organizational endpoint, identify the service and credential type, and retain forensic evidence of the exposure.
For supported credentials, the platform can also check validation status, according to the company. Its interface lets analysts filter findings by service, employee, token type, breach date, severity and validation state, with details including the internal file path and malware metadata.
The release reflects a change in incident response as developer workstations accumulate credentials that may remain active independently of passwords and browser sessions. Lunar said stolen tokens can provide access to source-code repositories, cloud infrastructure, SaaS platforms and AI APIs, so remediation may require rotation or revocation alongside endpoint cleanup.
Lunar positions the capability as complementary to repository secret scanning, secrets-management and non-human identity-security products. Those tools help organizations control credentials internally, while Token Exposure Monitoring is intended to identify credentials that malware has already extracted from an endpoint.
For security operations teams, the value will depend on accurate attribution, validation coverage and integration into an existing response process. Lunar said the capability is available in its Essential and Pro tiers.