Skip to content
INFOSTEALERS By HudsonRock
Weekly intelligence Aug 24 – Aug 31, 2026 12 min read

Infostealers Weekly Report: 2026-08-24 – 2026-08-31

InfoStealers Weekly Report - In this comprehensive report, we provide you with valuable insights into the most pressing threats facing organizations today. As cyberattacks continue to grow in complexity and scale, our mission is to equip you with the knowledge and tools needed to safeguard your sensitive information. Join us as we analyze the top compromised domains, identify trends in compromised employees and users, and examine the global impact of InfoStealer infections. Stay informed, stay protected, and stay one step ahead of cyber threats with our weekly report and info-stealers statistics.

#1 12,546 Compromised Machines
#2 1,181 Compromised Employees
#3 6,068 Compromised Users
#4 5,297 Compromised Androids
#5 83,129 Compromised Domains
Check if you are exposed All reports →

Threat Geography

Where infections came from

Compromised machines distributed by country of infection — hover any region to inspect.

Top 25 of 142
Infections by country

Top 25 countries

  1. #1 India 1,451
  2. #2 Bangladesh 470
  3. #3 Philippines 143
  4. #4 Indonesia 134
  5. #5 Pakistan 97
  6. #6 United States of America 95
  7. #7 Brazil 83
  8. #8 Sri Lanka 72
  9. #9 Nepal 70
  10. #10 South Africa 62
  11. #11 Ghana 59
  12. #12 Tanzania 58
  13. #13 Uganda 54
  14. #14 Mexico 53
  15. #15 Morocco 53
  16. #16 Nigeria 52
  17. #17 Malaysia 47
  18. #18 Colombia 43
  19. #19 Kenya 43
  20. #20 Côte d’Ivoire 40
  21. #21 Unknown Region 37
  22. #22 Ethiopia 35
  23. #23 Germany 34
  24. #24 Vietnam 31
  25. #25 Tunisia 30

Top Compromised Domains

Where users had active sessions

Domains where infected users had active sessions and saved credentials at the time of infection.

Top 25
  1. #1 google.com 5,277 users
  2. #2 facebook.com 3,330 users
  3. #3 instagram.com 2,668 users
  4. #4 com.instagram.android 2,667 users
  5. #5 com.facebook.katana 2,658 users
  6. #6 live.com 2,512 users
  7. #7 amazon.com 1,447 users
  8. #8 com.snapchat.android 1,402 users
  9. #9 amazon.in 1,368 users
  10. #10 com.netflix.mediaclient 1,309 users
  11. #11 netflix.com 1,266 users
  12. #12 linkedin.com 1,022 users
  13. #13 android 992 users
  14. #14 openai.com 984 users
  15. #15 com.pinterest 928 users
  16. #16 microsoftonline.com 910 users
  17. #17 discord.com 840 users
  18. #18 com.spotify.music 816 users
  19. #19 com.gaana 794 users
  20. #20 apple.com 789 users
  21. #21 irctc.co.in 696 users
  22. #22 paypal.com 674 users
  23. #23 github.com 672 users
  24. #24 twitter.com 665 users
  25. #25 zoom.us 662 users

Top Compromised Corporate Domains

Employees caught in the logs

Domains where compromised users were employees, surfaced via business email and credentials.

Top 25
  1. #1 icicibank.com 69 employees
  2. #2 android 63 employees
  3. #3 rediff.com 42 employees
  4. #4 hostinger.com 35 employees
  5. #5 netpnb.com 29 employees
  6. #6 icai.org 29 employees
  7. #7 bobibanking.com 28 employees
  8. #8 unionbankonline.co.in 23 employees
  9. #9 njoyn.com 18 employees
  10. #10 pnbibanking.in 16 employees
  11. #11 bankofbaroda.bank.in 13 employees
  12. #12 accenture.com 12 employees
  13. #13 mail.gov.in 11 employees
  14. #14 icici.bank.in 10 employees
  15. #15 fednetbank.com 10 employees
  16. #16 indusind.com 9 employees
  17. #17 jio.com 9 employees
  18. #18 indiapost.gov.in 8 employees
  19. #19 sjp.ac.lk 7 employees
  20. #20 unisa.ac.za 7 employees
  21. #21 web-hosting.com 7 employees
  22. #22 pnb.bank.in 7 employees
  23. #23 amityonline.com 7 employees
  24. #24 microsoft.com 7 employees
  25. #25 infosys.com 6 employees

Fortune 500 Exposure

Top S&P companies hit this week

Top S&P companies with compromised employees and customers detected this week.

Compromised employees

  1. #1 microsoft.com 7 employees
  2. #2 ibm.com 4 employees
  3. #3 salesforce.com 3 employees
  4. #4 cognizant.com 3 employees
  5. #5 pepsico.com 2 employees
  6. #6 cbre.com 2 employees
  7. #7 kiewit.com 1 employees
  8. #8 verizon.com 1 employees
  9. #9 jacobs.com 1 employees
  10. #10 gs.com 1 employees
  11. #11 rockwellautomation.com 1 employees

Compromised users

  1. #1 google.com 5,277 users
  2. #2 facebook.com 3,330 users
  3. #3 amazon.com 1,447 users
  4. #4 netflix.com 1,266 users
  5. #5 apple.com 789 users
  6. #6 paypal.com 674 users
  7. #7 oracle.com 214 users
  8. #8 hp.com 189 users
  9. #9 microsoft.com 130 users
  10. #10 ebay.com 119 users
  11. #11 ibm.com 91 users
  12. #12 cisco.com 79 users
  13. #13 nike.com 64 users
  14. #14 salesforce.com 50 users
  15. #15 walmart.com 38 users
  16. #16 intel.com 31 users
  17. #17 westernunion.com 21 users
  18. #18 broadcom.com 20 users
  19. #19 disney.com 19 users
  20. #20 ups.com 15 users

Compromised Mobile Apps

Top Android apps found in infected caches

The Android applications most frequently found in infected device caches this week.

Top 20
#1

Instagram

instagram.com · com.instagram.android

2,667 users

#2

Facebook

facebook.com · com.facebook.katana

2,658 users

#3

Snapchat

snapchat.com · com.snapchat.android

1,402 users

#4

Netflix

netflix.com · com.netflix.mediaclient

1,309 users

#5

Pinterest

pinterest.com · com.pinterest

928 users

#6

Spotify

spotify.com · com.spotify.music

816 users

#7

Discord

discord.com · com.discord

660 users

#8

Zoom

videomeetings.com · us.zoom.videomeetings

595 users

#9

Twitter

twitter.com · com.twitter.android

588 users

#10

Roblox

roblox.com · com.roblox.client

557 users

#11

LinkedIn

linkedin.com · com.linkedin.android

387 users

#12

Xiaomi

xiaomi.com · com.xiaomi.account

345 users

#13

PayPal

paypal.com · com.paypal.android.p2pmobile

232 users

#14

Mega

app.com · mega.privacy.android.app

229 users

#15

Twitch

app.com · tv.twitch.android.app

195 users

#16

Wish

contextlogic.com · com.contextlogic.wish

173 users

#17

Alibaba

alibaba.com · com.alibaba.aliexpresshd

59 users

#18

Waze

waze.com · com.waze

44 users

#19

Disney

disney.com · com.disney.disneyplus

33 users

#20

Mercadolibre

mercadolibre.com · com.mercadolibre

26 users

Top Compromised Email Providers

Email domains tied to compromised credentials

Gmail, hotmail, and beyond — providers seen across this week's stealer logs.

Top 25
  1. #1 gmail.com 179,184 users
  2. #2 hotmail.com 6,352 users
  3. #3 yahoo.com 3,811 users
  4. #4 outlook.com 2,993 users
  5. #5 yahoo.fr 961 users
  6. #6 icloud.com 521 users
  7. #7 live.com 516 users
  8. #8 msn.com 322 users
  9. #9 hotmail.fr 273 users
  10. #10 live.com.mx 197 users
  11. #11 hotmail.co.uk 186 users
  12. #12 wanadoo.fr 184 users
  13. #13 ymail.com 145 users
  14. #14 yahoo.co.in 145 users
  15. #15 yahoo.com.br 138 users
  16. #16 proton.me 124 users
  17. #17 googlemail.com 121 users
  18. #18 mail.ru 119 users
  19. #19 email.com 77 users
  20. #20 mail.com 73 users
  21. #21 hotmail.it 66 users
  22. #22 yahoo.co.id 63 users
  23. #23 gmx.de 51 users
  24. #24 aol.com 46 users
  25. #25 hotmail.es 38 users

Top Compromised Social Platforms

Where saved sessions and logins lived

Social media services where compromised accounts had stored sessions or saved logins.

Top 19
  1. #1 facebook.com 3,330 accounts
  2. #2 twitter.com 665 accounts
  3. #3 instagram.com 2,668 accounts
  4. #4 linkedin.com 1,022 accounts
  5. #5 pinterest.com 381 accounts
  6. #6 tiktok.com 332 accounts
  7. #7 snapchat.com 452 accounts
  8. #8 reddit.com 117 accounts
  9. #9 youtube.com 21 accounts
  10. #10 weibo.com 2 accounts
  11. #11 vk.com 122 accounts
  12. #12 telegram.org 42 accounts
  13. #13 tumblr.com 57 accounts
  14. #14 discord.com 840 accounts
  15. #15 flickr.com 40 accounts
  16. #16 myspace.com 10 accounts
  17. #17 badoo.com 16 accounts
  18. #18 meetup.com 9 accounts
  19. #19 quora.com 49 accounts

Malware Landscape

Stealer families & anti-virus coverage

Malware families responsible for this week's infections, and the anti-virus solutions reported by infected hosts.

Stealer Families

  1. #1 Generic Stealer 9,999machines
  2. #2 Remus 1,368machines
  3. #3 Lumma 1,044machines
  4. #4 Acreed 134machines
  5. #5 Atomic 1machines

Anti-virus Coverage

  1. #1 Windows Defender 7,543machines
  2. #2 None 461machines
  3. #3 Kaspersky 56machines
  4. #4 Malwarebytes 37machines
  5. #5 Avast Antivirus 30machines
  6. #6 McAfee 28machines
  7. #7 Avast 22machines
  8. #8 Avast, Norton 19machines
  9. #9 Reason Cybersecurity 19machines
  10. #10 360 Total Security 17machines

Targeted Application Keywords

What attackers grep for

The most common application keywords seen across credential logs — auth, sso, vpn, and more.

Top 25
  1. #1 auth 16,871hits
  2. #2 sso 3,573hits
  3. #3 zoom 1,917hits
  4. #4 github 1,206hits
  5. #5 oracle 489hits
  6. #6 sap 365hits
  7. #7 salesforce 300hits
  8. #8 adfs 276hits
  9. #9 webmail 249hits
  10. #10 vpn 224hits
  11. #11 ping 203hits
  12. #12 sts 144hits
  13. #13 zendesk 119hits
  14. #14 owa 117hits
  15. #15 webex 110hits
  16. #16 st 103hits
  17. #17 cpanel 95hits
  18. #18 okta 72hits
  19. #19 twilio 67hits
  20. #20 ftp 65hits
  21. #21 kaspersky 60hits
  22. #22 gitlab 50hits
  23. #23 git 46hits
  24. #24 extranet 35hits
  25. #25 citrix 27hits

Cavalier · Continuous monitoring

Get this depth of insight on your own organization.

Cavalier turns this same intelligence into a continuous real-time feed of compromised employees, customers and third-party vendors for your business.

Get a free report Explore Cavalier →

More reports

Previous weekly briefings

View archive →
Aug 17 → Aug 24, 2026 13 min

Infostealers Weekly Report: 2026-08-17 – 2026-08-24

  • 32K machines
  • 7K users
  • 401K domains
View report →
Aug 10 → Aug 17, 2026 14 min

Infostealers Weekly Report: 2026-08-10 – 2026-08-17

  • 33K machines
  • 7K users
  • 473K domains
View report →
Aug 3 → Aug 10, 2026 13 min

Infostealers Weekly Report: 2026-08-03 – 2026-08-10

  • 38K machines
  • 8K users
  • 407K domains
View report →
Free Tools Check your exposure