Skip to content
INFOSTEALERS By HudsonRock
Threat feeds weekly Sep 21 – Sep 28, 2026 1 min read

Threat Feeds Weekly Report: 2026-09-21 – 2026-09-28

Threat Feeds Weekly Report — executive summary of Hudson Rock Cavalier threat intelligence feeds. This report covers aggregated statistics only: C2 infrastructure, PhaaS kit hosts, and ClickFix monitor activity for Sep 21 – Sep 28, 2026 (UTC).

#1 30,047 Total Feed Sightings
#2 89 Countries Observed
#3 22,712 C2 Host Sightings
#4 2,362 PhaaS Host Sightings
#5 170,983 ClickFix Sites

C2 Intelligence Feed

Infostealer command & control

Host sightings, stealer families and geography over the last 8 days (UTC).

22,712 hosts
22,712Host Sightings
31Distinct Families
89Countries Observed

Daily Volume

  1. Sep 211,332
  2. Sep 222,083
  3. Sep 235,161
  4. Sep 243,575
  5. Sep 253,063
  6. Sep 264,589
  7. Sep 272,249
  8. Sep 28660

Top Stealer Families

  1. #1stealc407hosts
  2. #2socgholish395hosts
  3. #3remus336hosts
  4. #4vidar278hosts
  5. #5santastealer124hosts
  6. #6redline91hosts
  7. #7agenttesla61hosts
  8. #8salatstealer55hosts
  9. #9lumma48hosts
  10. #10phantomstealer36hosts

Top Countries

  1. #1US10,218hosts
  2. #2DE2,009hosts
  3. #3FR1,590hosts
  4. #4BR1,012hosts
  5. #5IT814hosts
  6. #6IN632hosts
  7. #7GB578hosts
  8. #8NL454hosts
  9. #9SG406hosts
  10. #10ES345hosts

PhaaS Feed

Phishing-as-a-Service kits

Active kit hosts and geographic distribution over the last 8 days (UTC).

2,362 hosts
2,362Host Sightings
31Distinct Kits
35Countries Observed

Daily Volume

  1. Sep 21299
  2. Sep 22321
  3. Sep 23420
  4. Sep 24324
  5. Sep 25315
  6. Sep 26383
  7. Sep 27212
  8. Sep 2888

Top Phishing Kits

  1. #1sessionserpent510hosts
  2. #2legokit140hosts
  3. #3kali36556hosts
  4. #4remcos42hosts
  5. #5m0yv38hosts
  6. #6miarroba27hosts
  7. #7gcore25hosts
  8. #8gh0strat23hosts
  9. #9asyncrat18hosts
  10. #10quasar16hosts

Top Countries

  1. #1US1,503hosts
  2. #2SG110hosts
  3. #3FI56hosts
  4. #4DE50hosts
  5. #5JP49hosts
  6. #6GB36hosts
  7. #7NL30hosts
  8. #8RU29hosts
  9. #9FR21hosts
  10. #10HK10hosts

ClickFix Monitor

Fake CAPTCHA & clipboard hijacks

Tracked ClickFix sites across the Cavalier monitor — malicious flags, clipboard theft and fake CAPTCHAs.

170,983 sites
170,983Total Sites
4,973Malicious Flagged
4,973Clipboard Hijacked
1,401Fake CAPTCHA

7-Day Volume

  1. Sep 211,114
  2. Sep 221,767
  3. Sep 234,844
  4. Sep 243,365
  5. Sep 253,078
  6. Sep 264,502
  7. Sep 272,211
  8. Sep 28611

Top Countries

  1. #1US9,575sites
  2. #2DE1,881sites
  3. #3FR1,506sites
  4. #4BR1,006sites
  5. #5IT812sites
  6. #6IN619sites
  7. #7GB561sites
  8. #8SG403sites
  9. #9NL379sites
  10. #10ES344sites

Top Technologies

  1. #1hosting20,277sites
  2. #2isp768sites
  3. #3education31sites
  4. #4government10sites
  5. #5business3sites

Weekly Briefing

Join 20,000+ cybersecurity pros for the briefing.

Weekly infostealer updates, top compromised domains, trending stealer families and curated research from the Hudson Rock team. No fluff, no noise.

  • Weekly issue
  • Zero spam
  • Actionable intel
  • Unsubscribe anytime

Powered by Hudson Rock · By subscribing, you agree to our privacy policy. Unsubscribe anytime.

More threat feeds

Previous weekly summaries

View archive →
Free Tools Check your exposure