Skip to content
INFOSTEALERS By HudsonRock
Threat feeds weekly Nov 2 – Nov 9, 2026 1 min read

Threat Feeds Weekly Report: 2026-11-02 – 2026-11-09

Threat Feeds Weekly Report — executive summary of Hudson Rock Cavalier threat intelligence feeds. This report covers aggregated statistics only: C2 infrastructure, PhaaS kit hosts, and ClickFix monitor activity for Nov 2 – Nov 9, 2026 (UTC).

#1 44,429 Total Feed Sightings
#2 100 Countries Observed
#3 33,116 C2 Host Sightings
#4 5,131 PhaaS Host Sightings
#5 351,893 ClickFix Sites

C2 Intelligence Feed

Infostealer command & control

Host sightings, stealer families and geography over the last 8 days (UTC).

33,116 hosts
33,116Host Sightings
22Distinct Families
100Countries Observed

Daily Volume

  1. Nov 22,796
  2. Nov 311,569
  3. Nov 45,907
  4. Nov 51,440
  5. Nov 61,188
  6. Nov 71,359
  7. Nov 86,238
  8. Nov 92,619

Top Stealer Families

  1. #1socgholish404hosts
  2. #2amos49hosts
  3. #3remus35hosts
  4. #4lumma13hosts
  5. #5vidar11hosts
  6. #6salatstealer10hosts
  7. #7phantomstealer10hosts
  8. #8stealc9hosts
  9. #9cameleon7hosts
  10. #10xloader7hosts

Top Countries

  1. #1US17,448hosts
  2. #2DE2,555hosts
  3. #3FR1,703hosts
  4. #4BR1,089hosts
  5. #5IT1,064hosts
  6. #6GB819hosts
  7. #7NL684hosts
  8. #8IN652hosts
  9. #9SG426hosts
  10. #10PL390hosts

PhaaS Feed

Phishing-as-a-Service kits

Active kit hosts and geographic distribution over the last 8 days (UTC).

5,131 hosts
5,131Host Sightings
42Distinct Kits
60Countries Observed

Daily Volume

  1. Nov 21,010
  2. Nov 3313
  3. Nov 41,253
  4. Nov 5525
  5. Nov 6486
  6. Nov 7367
  7. Nov 8876
  8. Nov 9301

Top Phishing Kits

  1. #1masscollect2,460hosts
  2. #2basetask227hosts
  3. #3legokit98hosts
  4. #4samepath67hosts
  5. #5passtwice44hosts
  6. #6kali36543hosts
  7. #7sessionserpent39hosts
  8. #8csuite35hosts
  9. #9ghost26hosts
  10. #10eviltokens15hosts

Top Countries

  1. #1US1,715hosts
  2. #2FI601hosts
  3. #3DE577hosts
  4. #4NL562hosts
  5. #5RU351hosts
  6. #6LV97hosts
  7. #7PL72hosts
  8. #8HK70hosts
  9. #9FR61hosts
  10. #10SE41hosts

ClickFix Monitor

Fake CAPTCHA & clipboard hijacks

Tracked ClickFix sites across the Cavalier monitor — malicious flags, clipboard theft and fake CAPTCHAs.

351,893 sites
351,893Total Sites
6,182Malicious Flagged
6,182Clipboard Hijacked
1,864Fake CAPTCHA

7-Day Volume

  1. Nov 22,755
  2. Nov 311,177
  3. Nov 45,655
  4. Nov 51,353
  5. Nov 61,085
  6. Nov 71,222
  7. Nov 86,031
  8. Nov 92,539

Top Countries

  1. #1US16,771sites
  2. #2DE2,445sites
  3. #3FR1,626sites
  4. #4BR1,087sites
  5. #5IT1,058sites
  6. #6GB806sites
  7. #7IN650sites
  8. #8NL612sites
  9. #9SG421sites
  10. #10IR378sites

Top Technologies

  1. #1hosting29,947sites
  2. #2isp1,298sites
  3. #3education58sites
  4. #4business14sites
  5. #5government9sites

Weekly Briefing

Join 20,000+ cybersecurity pros for the briefing.

Weekly infostealer updates, top compromised domains, trending stealer families and curated research from the Hudson Rock team. No fluff, no noise.

  • Weekly issue
  • Zero spam
  • Actionable intel
  • Unsubscribe anytime

Powered by Hudson Rock · By subscribing, you agree to our privacy policy. Unsubscribe anytime.

More threat feeds

Previous weekly summaries

View archive →
Free Tools Check your exposure