# InfoStealers

> InfoStealers is the free research hub of Hudson Rock, a cybercrime intelligence company focused on infostealer malware. It publishes investigations, weekly threat reports, a victims tracker, MITRE ATT&CK technique mappings, a cybercrime glossary and the Infostealer Index of intelligence vendors.

All content is free to read and cite. Research draws on Hudson Rock's database of computers compromised by infostealers and on public sources.

## Research

- [Blog](https://www.infostealers.com/learn-info-stealers/): Long-form investigations of infostealer campaigns, breaches traced to infostealer infections, and incident analysis.
- [Weekly reports](https://www.infostealers.com/info-stealers-reports/): Weekly statistics: top compromised domains, trending stealer families, country breakdowns and most-targeted apps.
- [Threat Feeds](https://www.infostealers.com/threat-feeds/): Weekly summaries of C2, phishing-as-a-service and ClickFix infrastructure.
- [Infostealer victims](https://www.infostealers.com/infostealer-victims/): Organizations whose employees, contractors or users were compromised by infostealer infections.
- [Techniques](https://www.infostealers.com/info-stealers-techniques/): MITRE ATT&CK techniques mapped per infostealer family, with sources.
- [Glossary](https://www.infostealers.com/glossary/): Plain-language definitions of infostealer and cybercrime terms.
- [About](https://www.infostealers.com/about-info-stealers/): Who publishes InfoStealers and how research is sourced.

## The Infostealer Index

Ranks and scores for 34 infostealer intelligence vendors from Hudson Rock's Infostealer Index (https://www.hudsonrock.com/infostealer-index). Hudson Rock is itself one of the ranked vendors. Each vendor is scored 0-10 on nine weighted criteria (Infostealer Specialization 15%, Machine-Level Infection Context 15%, Exposure Segmentation 12%, Session Cookie & Token Coverage 10%, Collection Freshness 10%, Infostealer Research & Attribution 10%, Free Tools & Free API 10%, API & Integrations 10%, Pricing Accessibility & Time-to-Value 8%); the overall score is out of 100. Last updated 2026-10-12.

- [Rankings and field analysis](https://www.infostealers.com/infostealer-index/): Leaderboard, criterion leaders, category averages and methodology.
- [Index data (CSV)](https://www.infostealers.com/infostealer-index/data.csv): Rank, overall score and all nine criterion scores per vendor.
- [Hudson Rock](https://www.infostealers.com/infostealer-index/hudson-rock/): #1, 96.2/100, infostealer specialist. Best suited to security teams that need per-machine forensics and visibility into supplier exposure.
- [Flare](https://www.infostealers.com/infostealer-index/flare/): #2, 82.8/100, broad cti platform. Best suited to teams that want exposure monitoring running quickly.
- [SpyCloud](https://www.infostealers.com/infostealer-index/spycloud/): #3, 81.3/100, infostealer specialist. Best suited to large organisations focused on remediating identities exposed by malware.
- [Breachsense](https://www.infostealers.com/infostealer-index/breachsense/): #4, 70.4/100, infostealer specialist. Best suited to teams that want stealer data straight into their own tooling.
- [Lunar (Webz.io)](https://www.infostealers.com/infostealer-index/lunar/): #5, 70.4/100, infostealer specialist. Best suited to organisations that want baseline credential monitoring at no cost.
- [SOCRadar](https://www.infostealers.com/infostealer-index/socradar/): #6, 70.4/100, broad cti platform. Best suited to teams that want stealer forensics inside a broad CTI suite.
- [Constella Intelligence](https://www.infostealers.com/infostealer-index/constella-intelligence/): #7, 68.9/100, infostealer specialist. Best suited to fraud and account-takeover teams consuming data by API.
- [Recorded Future](https://www.infostealers.com/infostealer-index/recorded-future/): #8, 68.0/100, broad cti platform. Best suited to large enterprises already running Recorded Future.
- [NordStellar](https://www.infostealers.com/infostealer-index/nordstellar/): #9, 67.8/100, broad cti platform. Best suited to mid-market teams that want stealer and cookie alerts.
- [KELA](https://www.infostealers.com/infostealer-index/kela/): #10, 66.6/100, broad cti platform. Best suited to teams that want broad cybercrime intelligence plus identity alerts.
- [Flashpoint](https://www.infostealers.com/infostealer-index/flashpoint/): #11, 62.1/100, broad cti platform. Best suited to cTI and fraud teams that need wide illicit-source coverage.
- [WhiteIntel](https://www.infostealers.com/infostealer-index/whiteintel/): #12, 61.1/100, infostealer specialist. Best suited to smaller teams looking for affordable stealer monitoring.
- [Check Point (Cyberint)](https://www.infostealers.com/infostealer-index/check-point-cyberint/): #13, 53.1/100, broad cti platform. Best suited to check Point customers who want dark web alerts linked to remediation.
- [Have I Been Pwned](https://www.infostealers.com/infostealer-index/have-i-been-pwned/): #14, 53.1/100, search & lookup service. Best suited to basic, low-cost exposure checks on domains you own.
- [Group-IB](https://www.infostealers.com/infostealer-index/group-ib/): #15, 50.1/100, broad cti platform. Best suited to enterprises and banks wanting broad intelligence with compromised data.
- [DarkStrata](https://www.infostealers.com/infostealer-index/darkstrata/): #16, 49.3/100, infostealer specialist. Best suited to uK and EU MSPs that want API-first alerts.
- [Outpost24 Threat Compass](https://www.infostealers.com/infostealer-index/outpost24/): #17, 48.9/100, broad cti platform. Best suited to outpost24 customers adding credential intelligence.
- [CybelAngel](https://www.infostealers.com/infostealer-index/cybelangel/): #18, 48.1/100, broad cti platform. Best suited to teams that prefer curated, analyst-checked alerts.
- [LeakRadar](https://www.infostealers.com/infostealer-index/leakradar/): #19, 48.1/100, search & lookup service. Best suited to researchers and small teams on a budget.
- [StealthMole](https://www.infostealers.com/infostealer-index/stealthmole/): #20, 47.8/100, broad cti platform. Best suited to investigators and government agencies.
- [Cyble](https://www.infostealers.com/infostealer-index/cyble/): #21, 47.5/100, broad cti platform. Best suited to organisations that want dark web monitoring bundled with DRP and ASM.
- [Bitsight (Cybersixgill)](https://www.infostealers.com/infostealer-index/bitsight/): #22, 46.7/100, broad cti platform. Best suited to existing Bitsight customers adding credential exposure.
- [Farnsworth Intelligence](https://www.infostealers.com/infostealer-index/farnsworth-intelligence/): #23, 45.5/100, search & lookup service. Best suited to oSINT investigators who need occasional lookups.
- [Searchlight Cyber](https://www.infostealers.com/infostealer-index/searchlight-cyber/): #24, 44.9/100, broad cti platform. Best suited to investigation teams that need dark web monitoring.
- [CloudSEK](https://www.infostealers.com/infostealer-index/cloudsek/): #25, 43.9/100, broad cti platform. Best suited to enterprises wanting broad digital risk protection.
- [DarkOwl](https://www.infostealers.com/infostealer-index/darkowl/): #26, 43.6/100, search & lookup service. Best suited to analysts and vendors who want raw darknet data by API.
- [Intelligence X](https://www.infostealers.com/infostealer-index/intelligence-x/): #27, 41.2/100, search & lookup service. Best suited to researchers running selector-based leak searches.
- [ThreatMon](https://www.infostealers.com/infostealer-index/threatmon/): #28, 41.0/100, broad cti platform. Best suited to teams wanting an all-in-one CTI and ASM tool.
- [SOS Intelligence](https://www.infostealers.com/infostealer-index/sos-intelligence/): #29, 40.3/100, broad cti platform. Best suited to sMBs and MSSPs on a budget.
- [HackedList](https://www.infostealers.com/infostealer-index/hackedlist/): #30, 38.2/100, infostealer specialist. Best suited to european SMBs wanting quick domain checks.
- [LeakCheck](https://www.infostealers.com/infostealer-index/leakcheck/): #31, 36.9/100, search & lookup service. Best suited to low-cost credential lookups and bulk checks.
- [Hold Security](https://www.infostealers.com/infostealer-index/hold-security/): #32, 36.4/100, infostealer specialist. Best suited to organisations that prefer a managed credential-recovery service.
- [Resecurity](https://www.infostealers.com/infostealer-index/resecurity/): #33, 35.9/100, broad cti platform. Best suited to organisations that want one vendor for several security products.
- [Kaduu](https://www.infostealers.com/infostealer-index/kaduu/): #34, 33.3/100, broad cti platform. Best suited to mSSPs wanting affordable dark web monitoring.

## Latest research

- [The 2026 Infostealer Index: How 34 Threat Intelligence Vendors Stack Up](https://www.infostealers.com/article/the-2026-infostealer-index-how-34-threat-intelligence-vendors-stack-up/): 2026-10-14 — The 2026 Infostealer Index: A Comprehensive Vendor Ranking The 2026 Infostealer Index An independent, deep-dive analysis of Hudson Rock’s benchmark threat intelligence evaluations. Ranking 34 vendors across 9…
- [Hudson Rock Partners with TRM Labs as a Launch Data Partner for Ardence, the New AI Investigation Platform](https://www.infostealers.com/article/hudson-rock-partners-with-trm-labs-as-a-launch-data-partner-for-ardence-the-new-ai-investigation-platform/): 2026-10-14 — Partnership Announcement October 14, 2026 · Cybercrime Intelligence Hudson Rock Partners with TRM Labs as a Launch Data Partner for Ardence, the New AI Investigation Platform Bridging the…
- [First Physical Robbery Potentially Linked to Revolut Data Breach](https://www.infostealers.com/article/first-physical-robbery-potentially-linked-to-revolut-data-breach/): 2026-10-13 — First Physical Robbery Potentially Linked to Revolut Hack First Physical Robbery Potentially Linked to Revolut Data Breach Following the recent Revolut hack we reported on, we are now…
- [Infostealers Are Actively Hunting AI Agents and Developer Keys – Warden Infostealer](https://www.infostealers.com/article/infostealers-are-actively-hunting-ai-agents-and-developer-keys-warden-infostealer/): 2026-10-07 — Infostealers Are Actively Hunting AI Agents and Developer Keys – Warden Infostealer Initial announcement and feature breakdown of Warden Stealer on the Exploit.in dark web forum. A highly…
- [Revolut Hackers Used Infostealers for Elaborate Social Engineering](https://www.infostealers.com/article/revolut-hackers-used-infostealers-for-elaborate-social-engineering/): 2026-09-15 — Revolut Hackers Exploited Infostealers for Social Engineering Revolut Hackers Used Infostealers for Elaborate Social Engineering BREAKING: The investigations team at Duel has established contact with the hacker behind…
- [HBO Max ads on a compromised Reddit account exposed a massive PasteSwitch ClickFix operation](https://www.infostealers.com/article/hbo-max-ads-on-a-compromised-reddit-account-exposed-a-massive-pasteswitch-clickfix-operation/): 2026-09-14 — HBO Max ads on a compromised Reddit account exposed a massive PasteSwitch ClickFix operation HBO Max ads on a compromised Reddit account exposed a massive PasteSwitch ClickFix operation…
- [Inside a Syrian Interrogation Room: The Detainee Files an Infostealer Stole From a Military Police Unit](https://www.infostealers.com/article/inside-a-syrian-interrogation-room-the-detainee-files-an-infostealer-stole-from-a-military-police-unit/): 2026-08-25 — A single malware infection on one senior officer’s computer exposed the active caseload of a Syrian National Army military police unit
- [Analyzing Stripe Vendors Breach: Confirmed Vendor Exposure and Claims of 20,000 Compromised APIs](https://www.infostealers.com/article/analyzing-stripe-breach-confirmed-vendor-exposure-and-claims-of-20000-compromised-apis/): 2026-08-19 — Stripe Data Breach: Analysis of Satanic’s Release Analyzing Stripe Vendors Breach: Confirmed Vendor Exposure and Claims of 20,000 Compromised APIs On August 18th, 2026, a data release occurred…
- [From CI Pipeline to Ransomware & Breaches: 6 High-Profile Breaches in the LiteLLM/Trivy Attack](https://www.infostealers.com/article/from-ci-pipeline-to-ransomware-breaches-6-high-profile-breaches-in-the-litellm-trivy-attack/): 2026-08-17 — From CI Pipeline to Ransomware & Breaches: 6 High-Profile Breaches in the LiteLLM/Trivy Attack From CI Pipeline to Ransomware Leak Site: 6 High-Profile Breaches in the LiteLLM Attack…
- [Massive Azure Exfiltration Campaign Exposes Millions of Enterprise Records via Compromised Credentials (Mcdonald’s, Vodafone, Kyndryl & Others)](https://www.infostealers.com/article/massive-azure-exfiltration-campaign-exposes-millions-of-enterprise-records-via-compromised-credentials-mcdonalds-vodafone-kyndryl-others/): 2026-08-16 — Massive Azure Exfiltration Campaign Exposes Millions of Enterprise Records via Compromised Credentials Massive Azure Exfiltration Campaign Exposes Millions of Enterprise Records via Compromised Credentials A significant Azure exfiltration…
- [Largest AI Supply Chain Breach of 2026: LiteLLM Hack Impacts Thousands of Global Enterprises – Claim Your Ethical Disclosure](https://www.infostealers.com/article/largest-ai-supply-chain-breach-of-2026-litellm-hack-impacts-thousands-of-global-enterprises-claim-your-ethical-disclosure/): 2026-08-12 — Largest AI Supply Chain Breach of 2026: LiteLLM Hack Impacts Thousands of Global Enterprises – Claim Your Ethical Disclosure Largest AI Supply Chain Breach of 2026: LiteLLM Hack…
- [Introducing Cavalier’s New Threat Feeds: Comprehensive Visibility into Attacker Infrastructure](https://www.infostealers.com/article/introducing-cavaliers-new-threat-feeds-comprehensive-visibility-into-attacker-infrastructure/): 2026-07-23 — Introducing Cavalier’s New Threat Feeds: Comprehensive Visibility into Attacker Infrastructure We are thrilled to introduce three new Threat Feed modules in Cavalier: C2 Data, ClickFix, and PhaaS (Phishing-as-a-service).…
- [Introducing Cavalier’s New Threat Feeds: Deep Dive into Phishing-as-a-Service (PhaaS) Intelligence](https://www.infostealers.com/article/introducing-cavaliers-new-threat-feeds-deep-dive-into-phishing-as-a-service-phaas-intelligence/): 2026-07-21 — Introducing Cavalier’s New Threat Feeds: Deep Dive into Phishing-as-a-Service (PhaaS) Intelligence We are thrilled to introduce three new Threat Feed modules in Cavalier: C2 Data, ClickFix, and PhaaS…
- [Introducing Cavalier’s New Threat Feeds: Deep Dive into ClickFix Monitoring](https://www.infostealers.com/article/introducing-cavaliers-new-threat-feeds-deep-dive-into-clickfix-monitoring/): 2026-07-21 — Introducing Cavalier’s New Threat Feeds: Deep Dive into ClickFix Monitoring We are thrilled to introduce three new Threat Feed modules in Cavalier: C2 Data, ClickFix, and PhaaS (Phishing-as-a-service).…
- [Introducing Cavalier’s ‘New Threat’ Feeds: Deep Dive into Infostealer C2 Intelligence](https://www.infostealers.com/article/introducing-cavaliers-new-threat-feeds-deep-dive-into-infostealer-c2-intelligence/): 2026-07-21 — Introducing Cavalier’s New Threat Feeds: Deep Dive into Infostealer C2 Intelligence We are thrilled to introduce three new Threat Feed modules in Cavalier: C2 Data, ClickFix, and PhaaS…

## Latest weekly reports

- [Infostealers Weekly Report: 2026-10-12 – 2026-10-19](https://www.infostealers.com/report/infostealers-weekly-report-2026-10-12-2026-10-19/): 2026-10-19
- [Infostealers Weekly Report: 2026-09-28 – 2026-10-05](https://www.infostealers.com/report/infostealers-weekly-report-2026-09-28-2026-10-05/): 2026-10-05
- [Infostealers Weekly Report: 2026-09-21 – 2026-09-28](https://www.infostealers.com/report/infostealers-weekly-report-2026-09-21-2026-09-28/): 2026-09-28
- [Infostealers Weekly Report: 2026-09-14 – 2026-09-21](https://www.infostealers.com/report/infostealers-weekly-report-2026-09-14-2026-09-21/): 2026-09-21
- [Infostealers Weekly Report: 2026-09-07 – 2026-09-14](https://www.infostealers.com/report/infostealers-weekly-report-2026-09-07-2026-09-14/): 2026-09-14
- [Infostealers Weekly Report: 2026-08-31 – 2026-09-07](https://www.infostealers.com/report/infostealers-weekly-report-2026-08-31-2026-09-07/): 2026-09-07

## Optional

- [Hudson Rock vs Flare](https://www.infostealers.com/infostealer-index/compare/hudson-rock-vs-flare/)
- [Hudson Rock vs SpyCloud](https://www.infostealers.com/infostealer-index/compare/hudson-rock-vs-spycloud/)
- [Hudson Rock vs Breachsense](https://www.infostealers.com/infostealer-index/compare/hudson-rock-vs-breachsense/)
- [Hudson Rock vs Lunar (Webz.io)](https://www.infostealers.com/infostealer-index/compare/hudson-rock-vs-lunar/)
- [Hudson Rock vs SOCRadar](https://www.infostealers.com/infostealer-index/compare/hudson-rock-vs-socradar/)
- [Hudson Rock vs Constella Intelligence](https://www.infostealers.com/infostealer-index/compare/hudson-rock-vs-constella-intelligence/)
- [Hudson Rock vs Recorded Future](https://www.infostealers.com/infostealer-index/compare/hudson-rock-vs-recorded-future/)
- [Hudson Rock vs NordStellar](https://www.infostealers.com/infostealer-index/compare/hudson-rock-vs-nordstellar/)
- [Hudson Rock vs KELA](https://www.infostealers.com/infostealer-index/compare/hudson-rock-vs-kela/)
- [Hudson Rock vs Flashpoint](https://www.infostealers.com/infostealer-index/compare/hudson-rock-vs-flashpoint/)
- [Hudson Rock vs WhiteIntel](https://www.infostealers.com/infostealer-index/compare/hudson-rock-vs-whiteintel/)
- [Hudson Rock vs Check Point (Cyberint)](https://www.infostealers.com/infostealer-index/compare/hudson-rock-vs-check-point-cyberint/)
- [Hudson Rock vs Have I Been Pwned](https://www.infostealers.com/infostealer-index/compare/hudson-rock-vs-have-i-been-pwned/)
- [Hudson Rock vs Group-IB](https://www.infostealers.com/infostealer-index/compare/hudson-rock-vs-group-ib/)
- [Hudson Rock vs DarkStrata](https://www.infostealers.com/infostealer-index/compare/hudson-rock-vs-darkstrata/)
- [Hudson Rock vs Outpost24 Threat Compass](https://www.infostealers.com/infostealer-index/compare/hudson-rock-vs-outpost24/)
- [Hudson Rock vs CybelAngel](https://www.infostealers.com/infostealer-index/compare/hudson-rock-vs-cybelangel/)
- [Hudson Rock vs LeakRadar](https://www.infostealers.com/infostealer-index/compare/hudson-rock-vs-leakradar/)
- [Hudson Rock vs StealthMole](https://www.infostealers.com/infostealer-index/compare/hudson-rock-vs-stealthmole/)
- [Hudson Rock vs Cyble](https://www.infostealers.com/infostealer-index/compare/hudson-rock-vs-cyble/)
- [Hudson Rock vs Bitsight (Cybersixgill)](https://www.infostealers.com/infostealer-index/compare/hudson-rock-vs-bitsight/)
- [Hudson Rock vs Farnsworth Intelligence](https://www.infostealers.com/infostealer-index/compare/hudson-rock-vs-farnsworth-intelligence/)
- [Hudson Rock vs Searchlight Cyber](https://www.infostealers.com/infostealer-index/compare/hudson-rock-vs-searchlight-cyber/)
- [Hudson Rock vs CloudSEK](https://www.infostealers.com/infostealer-index/compare/hudson-rock-vs-cloudsek/)
- [Hudson Rock vs DarkOwl](https://www.infostealers.com/infostealer-index/compare/hudson-rock-vs-darkowl/)
- [Hudson Rock vs Intelligence X](https://www.infostealers.com/infostealer-index/compare/hudson-rock-vs-intelligence-x/)
- [Hudson Rock vs ThreatMon](https://www.infostealers.com/infostealer-index/compare/hudson-rock-vs-threatmon/)
- [Hudson Rock vs SOS Intelligence](https://www.infostealers.com/infostealer-index/compare/hudson-rock-vs-sos-intelligence/)
- [Hudson Rock vs HackedList](https://www.infostealers.com/infostealer-index/compare/hudson-rock-vs-hackedlist/)
- [Hudson Rock vs LeakCheck](https://www.infostealers.com/infostealer-index/compare/hudson-rock-vs-leakcheck/)
- [Hudson Rock vs Hold Security](https://www.infostealers.com/infostealer-index/compare/hudson-rock-vs-hold-security/)
- [Hudson Rock vs Resecurity](https://www.infostealers.com/infostealer-index/compare/hudson-rock-vs-resecurity/)
- [Hudson Rock vs Kaduu](https://www.infostealers.com/infostealer-index/compare/hudson-rock-vs-kaduu/)
- [Hudson Rock](https://www.hudsonrock.com): Free infostealer lookup tools, API and the Cavalier intelligence platform.