Threat actor Zestix operates as an initial access broker selling corporate data stolen from ShareFile, Nextcloud, and OwnCloud instances. Initial access obtained through credentials collected by info-stealing malware (RedLine, Lumma, Vidar) deployed on employee devices via malvertising or ClickFix attacks. Attackers parse infostealer logs for corporate cloud URLs, then use valid credentials to access file-sharing services lacking MFA protection. Stolen credentials found in criminal databases for years, indicating failure to rotate credentials or invalidate active sessions. Data volumes range from tens of gigabytes to several terabytes including sensitive corporate, government, and infrastructure data.