Skip to content
INFOSTEALERS By HudsonRock
Threat feeds weekly Aug 31 – Sep 7, 2026 1 min read

Threat Feeds Weekly Report: 2026-08-31 – 2026-09-07

Threat Feeds Weekly Report — executive summary of Hudson Rock Cavalier threat intelligence feeds. This report covers aggregated statistics only: C2 infrastructure, PhaaS kit hosts, and ClickFix monitor activity for Aug 31 – Sep 7, 2026 (UTC).

#1 20,314 Total Feed Sightings
#2 90 Countries Observed
#3 13,086 C2 Host Sightings
#4 2,617 PhaaS Host Sightings
#5 102,987 ClickFix Sites

C2 Intelligence Feed

Infostealer command & control

Host sightings, stealer families and geography over the last 8 days (UTC).

13,086 hosts
13,086Host Sightings
31Distinct Families
90Countries Observed

Daily Volume

  1. Aug 31803
  2. Sep 1818
  3. Sep 21,180
  4. Sep 31,673
  5. Sep 4629
  6. Sep 5658
  7. Sep 65,755
  8. Sep 71,570

Top Stealer Families

  1. #1stealc678hosts
  2. #2vidar593hosts
  3. #3remus498hosts
  4. #4socgholish367hosts
  5. #5salatstealer145hosts
  6. #6lumma140hosts
  7. #7agenttesla132hosts
  8. #8svcstealer125hosts
  9. #9cameleon114hosts
  10. #10redline111hosts

Top Countries

  1. #1US5,231hosts
  2. #2DE1,267hosts
  3. #3FR995hosts
  4. #4BR374hosts
  5. #5GB341hosts
  6. #6NL315hosts
  7. #7IT288hosts
  8. #8CH266hosts
  9. #9ES264hosts
  10. #10IN260hosts

PhaaS Feed

Phishing-as-a-Service kits

Active kit hosts and geographic distribution over the last 8 days (UTC).

2,617 hosts
2,617Host Sightings
37Distinct Kits
37Countries Observed

Daily Volume

  1. Aug 31421
  2. Sep 1656
  3. Sep 2350
  4. Sep 3397
  5. Sep 4303
  6. Sep 5258
  7. Sep 6173
  8. Sep 759

Top Phishing Kits

  1. #1sessionserpent266hosts
  2. #2kali365178hosts
  3. #3legokit99hosts
  4. #4eviltokens34hosts
  5. #5flowerstorm27hosts
  6. #6noderabbit26hosts
  7. #7breeze comet19hosts
  8. #8nakedpages14hosts
  9. #9gryxa13hosts
  10. #10gcore11hosts

Top Countries

  1. #1US1,784hosts
  2. #2SG59hosts
  3. #3DE46hosts
  4. #4HK40hosts
  5. #5FR35hosts
  6. #6NL31hosts
  7. #7FI31hosts
  8. #8GB29hosts
  9. #9CA22hosts
  10. #10BR22hosts

ClickFix Monitor

Fake CAPTCHA & clipboard hijacks

Tracked ClickFix sites across the Cavalier monitor — malicious flags, clipboard theft and fake CAPTCHAs.

102,987 sites
102,987Total Sites
4,611Malicious Flagged
4,611Clipboard Hijacked
1,269Fake CAPTCHA

7-Day Volume

  1. Aug 31587
  2. Sep 1621
  3. Sep 21,023
  4. Sep 31,457
  5. Sep 4451
  6. Sep 5494
  7. Sep 65,628
  8. Sep 71,461

Top Countries

  1. #1US4,542sites
  2. #2DE1,116sites
  3. #3FR982sites
  4. #4BR369sites
  5. #5GB323sites
  6. #6IT284sites
  7. #7NL268sites
  8. #8ES259sites
  9. #9CH254sites
  10. #10IN245sites

Top Technologies

  1. #1hosting11,045sites
  2. #2isp437sites
  3. #3education26sites
  4. #4government5sites
  5. #5business4sites

Weekly Briefing

Join 20,000+ cybersecurity pros for the briefing.

Weekly infostealer updates, top compromised domains, trending stealer families and curated research from the Hudson Rock team. No fluff, no noise.

  • Weekly issue
  • Zero spam
  • Actionable intel
  • Unsubscribe anytime

Powered by Hudson Rock · By subscribing, you agree to our privacy policy. Unsubscribe anytime.

More threat feeds

Previous weekly summaries

View archive →
Free Tools Check your exposure