Skip to content
INFOSTEALERS By HudsonRock
Threat feeds weekly Oct 26 – Nov 2, 2026 1 min read

Threat Feeds Weekly Report: 2026-10-26 – 2026-11-02

Threat Feeds Weekly Report — executive summary of Hudson Rock Cavalier threat intelligence feeds. This report covers aggregated statistics only: C2 infrastructure, PhaaS kit hosts, and ClickFix monitor activity for Oct 26 – Nov 2, 2026 (UTC).

#1 29,772 Total Feed Sightings
#2 88 Countries Observed
#3 20,099 C2 Host Sightings
#4 3,621 PhaaS Host Sightings
#5 322,019 ClickFix Sites

C2 Intelligence Feed

Infostealer command & control

Host sightings, stealer families and geography over the last 8 days (UTC).

20,099 hosts
20,099Host Sightings
19Distinct Families
88Countries Observed

Daily Volume

  1. Oct 261,735
  2. Oct 272,786
  3. Oct 282,245
  4. Oct 293,856
  5. Oct 303,502
  6. Oct 311,519
  7. Nov 12,449
  8. Nov 22,007

Top Stealer Families

  1. #1socgholish201hosts
  2. #2remus29hosts
  3. #3salatstealer13hosts
  4. #4vidar10hosts
  5. #5cameleon9hosts
  6. #6lumma7hosts
  7. #7amos6hosts
  8. #8stealc5hosts
  9. #9redline4hosts
  10. #10xloader4hosts

Top Countries

  1. #1US8,754hosts
  2. #2DE2,009hosts
  3. #3FR1,267hosts
  4. #4IT1,087hosts
  5. #5BR747hosts
  6. #6GB536hosts
  7. #7NL438hosts
  8. #8IN426hosts
  9. #9PL402hosts
  10. #10RU294hosts

PhaaS Feed

Phishing-as-a-Service kits

Active kit hosts and geographic distribution over the last 8 days (UTC).

3,621 hosts
3,621Host Sightings
32Distinct Kits
56Countries Observed

Daily Volume

  1. Oct 26188
  2. Oct 27382
  3. Oct 28635
  4. Oct 29730
  5. Oct 30333
  6. Oct 31275
  7. Nov 1197
  8. Nov 2881

Top Phishing Kits

  1. #1masscollect1,586hosts
  2. #2sessionserpent98hosts
  3. #3samepath68hosts
  4. #4csuite66hosts
  5. #5legokit64hosts
  6. #6kali36547hosts
  7. #7gcore36hosts
  8. #8ghost32hosts
  9. #9eviltokens20hosts
  10. #10miarroba19hosts

Top Countries

  1. #1US1,292hosts
  2. #2FI540hosts
  3. #3DE492hosts
  4. #4NL336hosts
  5. #5RU173hosts
  6. #6LV71hosts
  7. #7FR50hosts
  8. #8SG39hosts
  9. #9EE34hosts
  10. #10PL33hosts

ClickFix Monitor

Fake CAPTCHA & clipboard hijacks

Tracked ClickFix sites across the Cavalier monitor — malicious flags, clipboard theft and fake CAPTCHAs.

322,019 sites
322,019Total Sites
6,052Malicious Flagged
6,052Clipboard Hijacked
1,810Fake CAPTCHA

7-Day Volume

  1. Oct 261,724
  2. Oct 272,694
  3. Oct 282,202
  4. Oct 293,864
  5. Oct 303,509
  6. Oct 311,557
  7. Nov 12,013
  8. Nov 21,949

Top Countries

  1. #1US8,271sites
  2. #2DE1,919sites
  3. #3FR1,183sites
  4. #4IT1,083sites
  5. #5BR744sites
  6. #6GB517sites
  7. #7IN424sites
  8. #8PL388sites
  9. #9NL385sites
  10. #10RU272sites

Top Technologies

  1. #1hosting18,157sites
  2. #2isp735sites
  3. #3education43sites
  4. #4government8sites
  5. #5business6sites

Weekly Briefing

Join 20,000+ cybersecurity pros for the briefing.

Weekly infostealer updates, top compromised domains, trending stealer families and curated research from the Hudson Rock team. No fluff, no noise.

  • Weekly issue
  • Zero spam
  • Actionable intel
  • Unsubscribe anytime

Powered by Hudson Rock · By subscribing, you agree to our privacy policy. Unsubscribe anytime.

More threat feeds

Previous weekly summaries

View archive →
Free Tools Check your exposure