Skip to content
INFOSTEALERS By HudsonRock
Threat feeds weekly Jul 13 – Jul 20, 2026 1 min read

Threat Feeds Weekly Report: 2026-07-13 – 2026-07-20

Threat Feeds Weekly Report — executive summary of Hudson Rock Cavalier threat intelligence feeds. This report covers aggregated statistics only: C2 infrastructure, PhaaS kit hosts, and ClickFix monitor activity for Jul 13 – Jul 20, 2026 (UTC).

#1 9,087 Total Feed Sightings
#2 64 Countries Observed
#3 3,915 C2 Host Sightings
#4 1,357 PhaaS Host Sightings
#5 16,161 ClickFix Sites

C2 Intelligence Feed

Infostealer command & control

Host sightings, stealer families and geography over the last 8 days (UTC).

3,915 hosts
3,915Host Sightings
22Distinct Families
64Countries Observed

Daily Volume

  1. Jul 13422
  2. Jul 141,229
  3. Jul 15209
  4. Jul 16406
  5. Jul 17296
  6. Jul 18383
  7. Jul 19437
  8. Jul 20533

Top Stealer Families

  1. #1stealc171hosts
  2. #2lumma145hosts
  3. #3vidar103hosts
  4. #4redline75hosts
  5. #5svcstealer55hosts
  6. #6salatstealer52hosts
  7. #7blankgrabber13hosts
  8. #8risepro11hosts
  9. #9agenttesla11hosts
  10. #10exelastealer10hosts

Top Countries

  1. #1US2,061hosts
  2. #2DE288hosts
  3. #3FR199hosts
  4. #4BR100hosts
  5. #5IN93hosts
  6. #6GB84hosts
  7. #7NL69hosts
  8. #8IT66hosts
  9. #9ES61hosts
  10. #10SG58hosts

PhaaS Feed

Phishing-as-a-Service kits

Active kit hosts and geographic distribution over the last 8 days (UTC).

1,357 hosts
1,357Host Sightings
8Distinct Kits
26Countries Observed

Daily Volume

  1. Jul 13201
  2. Jul 14319
  3. Jul 15308
  4. Jul 1685
  5. Jul 17111
  6. Jul 1877
  7. Jul 1980
  8. Jul 20176

Top Phishing Kits

  1. #1sessionserpent220hosts
  2. #2eviltokens93hosts
  3. #3sneaky2fa50hosts
  4. #4honeystorm21hosts
  5. #5kali36516hosts
  6. #6omegalord12hosts
  7. #7jalisco5hosts
  8. #8forg3651hosts

Top Countries

  1. #1US552hosts
  2. #2NL193hosts
  3. #3ES84hosts
  4. #4SC50hosts
  5. #5HK33hosts
  6. #6GB29hosts
  7. #7DE14hosts
  8. #8BR7hosts
  9. #9FR6hosts
  10. #10BD5hosts

ClickFix Monitor

Fake CAPTCHA & clipboard hijacks

Tracked ClickFix sites across the Cavalier monitor — malicious flags, clipboard theft and fake CAPTCHAs.

16,161 sites
16,161Total Sites
3,815Malicious Flagged
3,815Clipboard Hijacked
946Fake CAPTCHA

7-Day Volume

  1. Jul 13399
  2. Jul 141,205
  3. Jul 15208
  4. Jul 16316
  5. Jul 17258
  6. Jul 18375
  7. Jul 19379
  8. Jul 20395

Top Countries

  1. #1US1,953sites
  2. #2DE201sites
  3. #3FR191sites
  4. #4BR100sites
  5. #5IN93sites
  6. #6GB71sites
  7. #7IT66sites
  8. #8ES59sites
  9. #9SG55sites
  10. #10NL38sites

Top Technologies

  1. #1hosting3,230sites
  2. #2isp81sites
  3. #3education11sites
  4. #4business3sites

Weekly Briefing

Join 15,000+ cybersecurity pros for the briefing.

Weekly infostealer updates, top compromised domains, trending stealer families and curated research from the Hudson Rock team. No fluff, no noise.

  • Weekly issue
  • Zero spam
  • Actionable intel
  • Unsubscribe anytime

Powered by Hudson Rock · By subscribing, you agree to our privacy policy. Unsubscribe anytime.

More threat feeds

Previous weekly summaries

View archive →
Free Tools Check your exposure