Skip to content
INFOSTEALERS By HudsonRock
Threat feeds weekly Jul 20 – Jul 27, 2026 1 min read

Threat Feeds Weekly Report: 2026-07-20 – 2026-07-27

Threat Feeds Weekly Report — executive summary of Hudson Rock Cavalier threat intelligence feeds. This report covers aggregated statistics only: C2 infrastructure, PhaaS kit hosts, and ClickFix monitor activity for Jul 20 – Jul 27, 2026 (UTC).

#1 18,148 Total Feed Sightings
#2 76 Countries Observed
#3 8,062 C2 Host Sightings
#4 6,028 PhaaS Host Sightings
#5 22,223 ClickFix Sites

C2 Intelligence Feed

Infostealer command & control

Host sightings, stealer families and geography over the last 8 days (UTC).

8,062 hosts
8,062Host Sightings
20Distinct Families
76Countries Observed

Daily Volume

  1. Jul 20533
  2. Jul 211,108
  3. Jul 22583
  4. Jul 23876
  5. Jul 24431
  6. Jul 25294
  7. Jul 26456
  8. Jul 273,781

Top Stealer Families

  1. #1socgholish1,168hosts
  2. #2lumma249hosts
  3. #3stealc227hosts
  4. #4svcstealer124hosts
  5. #5salatstealer120hosts
  6. #6redline114hosts
  7. #7vidar109hosts
  8. #8gurcu109hosts
  9. #9agenttesla60hosts
  10. #10risepro33hosts

Top Countries

  1. #1US3,913hosts
  2. #2DE601hosts
  3. #3FR424hosts
  4. #4CA297hosts
  5. #5BR222hosts
  6. #6NL202hosts
  7. #7IN183hosts
  8. #8IT176hosts
  9. #9GB175hosts
  10. #10SG145hosts

PhaaS Feed

Phishing-as-a-Service kits

Active kit hosts and geographic distribution over the last 8 days (UTC).

6,028 hosts
6,028Host Sightings
21Distinct Kits
28Countries Observed

Daily Volume

  1. Jul 20176
  2. Jul 21169
  3. Jul 22144
  4. Jul 23152
  5. Jul 24172
  6. Jul 25279
  7. Jul 264,431
  8. Jul 27505

Top Phishing Kits

  1. #1sessionserpent395hosts
  2. #2kali365351hosts
  3. #3miarroba181hosts
  4. #4eviltokens77hosts
  5. #5gcore71hosts
  6. #6darcula49hosts
  7. #7sneaky2fa42hosts
  8. #8honeystorm29hosts
  9. #9bluenoroff27hosts
  10. #10mamba2fa25hosts

Top Countries

  1. #1US4,967hosts
  2. #2ES152hosts
  3. #3HK103hosts
  4. #4GB89hosts
  5. #5FR51hosts
  6. #6NL43hosts
  7. #7DE18hosts
  8. #8CA15hosts
  9. #9MX15hosts
  10. #10BR13hosts

ClickFix Monitor

Fake CAPTCHA & clipboard hijacks

Tracked ClickFix sites across the Cavalier monitor — malicious flags, clipboard theft and fake CAPTCHAs.

22,223 sites
22,223Total Sites
4,058Malicious Flagged
4,058Clipboard Hijacked
995Fake CAPTCHA

7-Day Volume

  1. Jul 20395
  2. Jul 21431
  3. Jul 22416
  4. Jul 23487
  5. Jul 24375
  6. Jul 25261
  7. Jul 26324
  8. Jul 273,768

Top Countries

  1. #1US3,205sites
  2. #2DE399sites
  3. #3FR340sites
  4. #4CA281sites
  5. #5BR204sites
  6. #6IN175sites
  7. #7GB137sites
  8. #8SG132sites
  9. #9IT102sites
  10. #10NL90sites

Top Technologies

  1. #1hosting5,937sites
  2. #2isp169sites
  3. #3education17sites
  4. #4business6sites
  5. #5government2sites

Weekly Briefing

Join 15,000+ cybersecurity pros for the briefing.

Weekly infostealer updates, top compromised domains, trending stealer families and curated research from the Hudson Rock team. No fluff, no noise.

  • Weekly issue
  • Zero spam
  • Actionable intel
  • Unsubscribe anytime

Powered by Hudson Rock · By subscribing, you agree to our privacy policy. Unsubscribe anytime.

More threat feeds

Previous weekly summaries

View archive →
Free Tools Check your exposure