Skip to content
INFOSTEALERS By HudsonRock
Weekly intelligence Jul 15 – Jul 22, 2024 14 min read

Infostealers Weekly Report: 2024-07-15 – 2024-07-22

InfoStealers Weekly Report - In this comprehensive report, we provide you with valuable insights into the most pressing threats facing organizations today. As cyberattacks continue to grow in complexity and scale, our mission is to equip you with the knowledge and tools needed to safeguard your sensitive information. Join us as we analyze the top compromised domains, identify trends in compromised employees and users, and examine the global impact of InfoStealer infections. Stay informed, stay protected, and stay one step ahead of cyber threats with our weekly report and info-stealers statistics.

#1 86,947 Compromised Machines
#2 17,330 Compromised Employees
#3 25,076 Compromised Users
#4 44,541 Compromised Androids
#5 506,034 Compromised Domains
Check if you are exposed All reports →

Threat Geography

Where infections came from

Compromised machines distributed by country of infection — hover any region to inspect.

Top 25 of 205
Infections by country

Top 25 countries

  1. #1 India 6,064
  2. #2 Brazil 5,063
  3. #3 Indonesia 3,983
  4. #4 Pakistan 3,288
  5. #5 Thailand 3,188
  6. #6 Turkey 3,005
  7. #7 Egypt 2,719
  8. #8 Philippines 2,543
  9. #9 Mexico 2,279
  10. #10 Argentina 2,106
  11. #11 Vietnam 2,073
  12. #12 Colombia 1,820
  13. #13 Spain 1,591
  14. #14 Peru 1,484
  15. #15 Bangladesh 1,107
  16. #16 Poland 1,105
  17. #17 Chile 1,074
  18. #18 Algeria 953
  19. #19 United States of America 903
  20. #20 Taiwan 869
  21. #21 Morocco 866
  22. #22 France 793
  23. #23 Malaysia 699
  24. #24 Romania 696
  25. #25 Venezuela 670

Top Compromised Domains

Where users had active sessions

Domains where infected users had active sessions and saved credentials at the time of infection.

Top 25
  1. #1 google.com 55,591 users
  2. #2 facebook.com 47,494 users
  3. #3 live.com 45,265 users
  4. #4 instagram.com 25,886 users
  5. #5 discord.com 24,841 users
  6. #6 com.facebook.katana 23,635 users
  7. #7 netflix.com 22,515 users
  8. #8 roblox.com 21,337 users
  9. #9 steampowered.com 19,540 users
  10. #10 amazon.com 18,147 users
  11. #11 com.instagram.android 16,829 users
  12. #12 twitter.com 16,658 users
  13. #13 com.netflix.mediaclient 16,266 users
  14. #14 microsoftonline.com 14,823 users
  15. #15 spotify.com 14,257 users
  16. #16 paypal.com 14,005 users
  17. #17 twitch.tv 13,872 users
  18. #18 riotgames.com 13,229 users
  19. #19 epicgames.com 13,128 users
  20. #20 mega.nz 12,235 users
  21. #21 apple.com 12,147 users
  22. #22 com.roblox.client 11,738 users
  23. #23 linkedin.com 11,426 users
  24. #24 com.discord 11,195 users
  25. #25 steamcommunity.com 10,793 users

Top Compromised Corporate Domains

Employees caught in the logs

Domains where compromised users were employees, surfaced via business email and credentials.

Top 25
  1. #1 hostinger.com 305 employees
  2. #2 icicibank.com 245 employees
  3. #3 wp.pl 206 employees
  4. #4 secop.gov.co 175 employees
  5. #5 firstmail.ltd 169 employees
  6. #6 rediff.com 158 employees
  7. #7 buenosaires.gob.ar 122 employees
  8. #8 watchit.com 101 employees
  9. #9 163.com 101 employees
  10. #10 abv.bg 100 employees
  11. #11 o2.pl 94 employees
  12. #12 secureserver.net 88 employees
  13. #13 skole.hr 88 employees
  14. #14 laureate.net 87 employees
  15. #15 qq.com 84 employees
  16. #16 onet.pl 83 employees
  17. #17 mail.tm 76 employees
  18. #18 atlassian.com 75 employees
  19. #19 bni.co.id 75 employees
  20. #20 freemail.hu 75 employees
  21. #21 interia.pl 75 employees
  22. #22 sts.net.pk 75 employees
  23. #23 santander.com.br 71 employees
  24. #24 sempreser.com.br 69 employees
  25. #25 jwpub.org 69 employees

Fortune 500 Exposure

Top S&P companies hit this week

Top S&P companies with compromised employees and customers detected this week.

Compromised employees

  1. #1 microsoft.com 65 employees
  2. #2 rockwellautomation.com 57 employees
  3. #3 ibm.com 13 employees
  4. #4 frontier.com 9 employees
  5. #5 netflix.com 9 employees
  6. #6 google.com 9 employees
  7. #7 amazon.com 6 employees
  8. #8 publix.com 6 employees
  9. #9 ups.com 6 employees
  10. #10 pg.com 5 employees
  11. #11 hp.com 5 employees
  12. #12 cbre.com 5 employees
  13. #13 cognizant.com 4 employees
  14. #14 jll.com 4 employees
  15. #15 unitedhealthgroup.com 4 employees
  16. #16 halliburton.com 4 employees
  17. #17 apple.com 3 employees
  18. #18 morganstanley.com 3 employees
  19. #19 xerox.com 3 employees
  20. #20 xpo.com 3 employees

Compromised users

  1. #1 google.com 55,591 users
  2. #2 facebook.com 47,494 users
  3. #3 netflix.com 22,515 users
  4. #4 amazon.com 18,147 users
  5. #5 paypal.com 14,005 users
  6. #6 apple.com 12,147 users
  7. #7 ebay.com 2,435 users
  8. #8 hp.com 2,084 users
  9. #9 oracle.com 1,949 users
  10. #10 microsoft.com 1,740 users
  11. #11 nike.com 1,670 users
  12. #12 cisco.com 1,373 users
  13. #13 ibm.com 666 users
  14. #14 walmart.com 531 users
  15. #15 ups.com 511 users
  16. #16 intel.com 404 users
  17. #17 westernunion.com 395 users
  18. #18 fedex.com 318 users
  19. #19 salesforce.com 271 users
  20. #20 adp.com 223 users

Compromised Mobile Apps

Top Android apps found in infected caches

The Android applications most frequently found in infected device caches this week.

Top 20
#1

Facebook

facebook.com · com.facebook.katana

23,635 users

#2

Instagram

instagram.com · com.instagram.android

16,829 users

#3

Netflix

netflix.com · com.netflix.mediaclient

16,266 users

#4

Roblox

roblox.com · com.roblox.client

11,738 users

#5

Discord

discord.com · com.discord

11,195 users

#6

Twitch

app.com · tv.twitch.android.app

9,022 users

#7

Spotify

spotify.com · com.spotify.music

8,622 users

#8

Twitter

twitter.com · com.twitter.android

7,034 users

#9

Snapchat

snapchat.com · com.snapchat.android

6,914 users

#10

Disney

disney.com · com.disney.disneyplus

4,281 users

#11

PayPal

paypal.com · com.paypal.android.p2pmobile

4,280 users

#12

Mega

app.com · mega.privacy.android.app

3,682 users

#13

Zoom

videomeetings.com · us.zoom.videomeetings

3,682 users

#14

Mercadolibre

mercadolibre.com · com.mercadolibre

3,327 users

#15

Wish

contextlogic.com · com.contextlogic.wish

3,060 users

#16

LinkedIn

linkedin.com · com.linkedin.android

2,921 users

#17

Xiaomi

xiaomi.com · com.xiaomi.account

2,855 users

#18

Waze

waze.com · com.waze

2,483 users

#19

Pinterest

pinterest.com · com.pinterest

2,402 users

#20

Alibaba

alibaba.com · com.alibaba.aliexpresshd

2,270 users

Top Compromised Email Providers

Email domains tied to compromised credentials

Gmail, hotmail, and beyond — providers seen across this week's stealer logs.

Top 25
  1. #1 gmail.com 2,101,951 users
  2. #2 hotmail.com 270,480 users
  3. #3 yahoo.com 76,672 users
  4. #4 outlook.com 59,695 users
  5. #5 icloud.com 14,272 users
  6. #6 live.com 7,748 users
  7. #7 hotmail.es 5,999 users
  8. #8 yahoo.com.br 5,982 users
  9. #9 yahoo.fr 5,941 users
  10. #10 msn.com 4,389 users
  11. #11 hotmail.fr 3,817 users
  12. #12 mail.ru 3,259 users
  13. #13 yahoo.co.id 2,923 users
  14. #14 yahoo.com.ar 2,696 users
  15. #15 ymail.com 2,693 users
  16. #16 mail.com 1,965 users
  17. #17 live.fr 1,933 users
  18. #18 hotmail.co.uk 1,919 users
  19. #19 aol.com 1,826 users
  20. #20 libero.it 1,805 users
  21. #21 yahoo.com.mx 1,771 users
  22. #22 gmx.de 1,756 users
  23. #23 web.de 1,752 users
  24. #24 t-online.de 1,651 users
  25. #25 orange.fr 1,609 users

Top Compromised Social Platforms

Where saved sessions and logins lived

Social media services where compromised accounts had stored sessions or saved logins.

Top 19
  1. #1 facebook.com 47,494 accounts
  2. #2 twitter.com 16,658 accounts
  3. #3 instagram.com 25,886 accounts
  4. #4 linkedin.com 11,427 accounts
  5. #5 pinterest.com 4,237 accounts
  6. #6 tiktok.com 5,109 accounts
  7. #7 snapchat.com 5,260 accounts
  8. #8 reddit.com 2,206 accounts
  9. #9 youtube.com 302 accounts
  10. #10 weibo.com 197 accounts
  11. #11 vk.com 2,477 accounts
  12. #12 telegram.org 492 accounts
  13. #13 tumblr.com 1,267 accounts
  14. #14 discord.com 24,841 accounts
  15. #15 flickr.com 652 accounts
  16. #16 myspace.com 79 accounts
  17. #17 badoo.com 520 accounts
  18. #18 meetup.com 51 accounts
  19. #19 quora.com 235 accounts

Malware Landscape

Stealer families & anti-virus coverage

Malware families responsible for this week's infections, and the anti-virus solutions reported by infected hosts.

Stealer Families

  1. #1 StealC 53,261machines
  2. #2 RedLine 24,152machines
  3. #3 Generic Stealer 6,825machines
  4. #4 Vidar 2,068machines
  5. #5 Lumma 641machines

Anti-virus Coverage

  1. #1 Windows Defender 24,592machines
  2. #2 Reason Cybersecurity 1,641machines
  3. #3 Avast Antivirus 987machines
  4. #4 360 Total Security 740machines
  5. #5 McAfee 600machines
  6. #6 McAfee Firewall 318machines
  7. #7 Unknown 308machines
  8. #8 McAfee VirusScan 284machines
  9. #9 AVG Antivirus 258machines
  10. #10 Kaspersky 175machines

Targeted Application Keywords

What attackers grep for

The most common application keywords seen across credential logs — auth, sso, vpn, and more.

Top 25
  1. #1 auth 225,549hits
  2. #2 sso 65,050hits
  3. #3 zoom 20,571hits
  4. #4 github 11,624hits
  5. #5 webmail 7,326hits
  6. #6 adfs 6,262hits
  7. #7 oracle 4,114hits
  8. #8 zendesk 3,196hits
  9. #9 sap 2,772hits
  10. #10 owa 2,718hits
  11. #11 sts 2,337hits
  12. #12 ping 2,204hits
  13. #13 cpanel 2,161hits
  14. #14 vpn 2,125hits
  15. #15 webex 1,469hits
  16. #16 extranet 1,382hits
  17. #17 kaspersky 1,312hits
  18. #18 ftp 1,058hits
  19. #19 st 1,038hits
  20. #20 roundcube 995hits
  21. #21 salesforce 911hits
  22. #22 okta 806hits
  23. #23 twilio 557hits
  24. #24 zimbra 503hits
  25. #25 imap 503hits

Cavalier · Continuous monitoring

Get this depth of insight on your own organization.

Cavalier turns this same intelligence into a continuous real-time feed of compromised employees, customers and third-party vendors for your business.

Get a free report Explore Cavalier →

More reports

Previous weekly briefings

View archive →
Jul 13 → Jul 20, 2026 14 min

Infostealers Weekly Report: 2026-07-13 – 2026-07-20

  • 30K machines
  • 2K users
  • 362K domains
View report →
Jul 6 → Jul 13, 2026 13 min

Infostealers Weekly Report: 2026-07-06 – 2026-07-13

  • 15K machines
  • 2K users
  • 180K domains
View report →
Jun 29 → Jul 6, 2026 13 min

Infostealers Weekly Report: 2026-06-29 – 2026-07-06

  • 22K machines
  • 5K users
  • 186K domains
View report →
Free Tools Check your exposure