Skip to content
INFOSTEALERS By HudsonRock
Weekly intelligence May 12 – May 19, 2025 11 min read

Infostealers Weekly Report: 2025-05-12 – 2025-05-19

InfoStealers Weekly Report - In this comprehensive report, we provide you with valuable insights into the most pressing threats facing organizations today. As cyberattacks continue to grow in complexity and scale, our mission is to equip you with the knowledge and tools needed to safeguard your sensitive information. Join us as we analyze the top compromised domains, identify trends in compromised employees and users, and examine the global impact of InfoStealer infections. Stay informed, stay protected, and stay one step ahead of cyber threats with our weekly report and info-stealers statistics.

#1 4,630 Compromised Machines
#2 1,124 Compromised Employees
#3 756 Compromised Users
#4 2,750 Compromised Androids
#5 64,921 Compromised Domains
Check if you are exposed All reports →

Threat Geography

Where infections came from

Compromised machines distributed by country of infection — hover any region to inspect.

Top 25 of 139
Infections by country

Top 25 countries

  1. #1 India 448
  2. #2 Brazil 293
  3. #3 Philippines 224
  4. #4 Indonesia 198
  5. #5 Vietnam 189
  6. #6 Pakistan 140
  7. #7 Argentina 117
  8. #8 South Africa 86
  9. #9 Bangladesh 81
  10. #10 United States of America 75
  11. #11 Colombia 60
  12. #12 Turkey 60
  13. #13 Thailand 59
  14. #14 Mexico 57
  15. #15 Romania 56
  16. #16 Kenya 55
  17. #17 Malaysia 55
  18. #18 Egypt 53
  19. #19 Morocco 51
  20. #20 Algeria 49
  21. #21 Serbia 47
  22. #22 Portugal 39
  23. #23 Nepal 34
  24. #24 Peru 27
  25. #25 Saudi Arabia 26

Top Compromised Domains

Where users had active sessions

Domains where infected users had active sessions and saved credentials at the time of infection.

Top 25
  1. #1 google.com 3,071 users
  2. #2 facebook.com 2,656 users
  3. #3 live.com 2,304 users
  4. #4 instagram.com 1,571 users
  5. #5 com.facebook.katana 1,374 users
  6. #6 netflix.com 1,345 users
  7. #7 discord.com 1,215 users
  8. #8 amazon.com 1,164 users
  9. #9 com.instagram.android 1,073 users
  10. #10 com.netflix.mediaclient 986 users
  11. #11 roblox.com 959 users
  12. #12 paypal.com 945 users
  13. #13 apple.com 901 users
  14. #14 twitter.com 898 users
  15. #15 steampowered.com 892 users
  16. #16 spotify.com 830 users
  17. #17 linkedin.com 828 users
  18. #18 microsoftonline.com 772 users
  19. #19 192.168.1.1 739 users
  20. #20 yahoo.com 721 users
  21. #21 mega.nz 714 users
  22. #22 com.pinterest 694 users
  23. #23 com.spotify.music 661 users
  24. #24 twitch.tv 627 users
  25. #25 com.discord 622 users

Top Compromised Corporate Domains

Employees caught in the logs

Domains where compromised users were employees, surfaced via business email and credentials.

Top 25
  1. #1 hostinger.com 50 employees
  2. #2 icicibank.com 35 employees
  3. #3 buenosaires.gob.ar 23 employees
  4. #4 rediff.com 20 employees
  5. #5 telecom.pt 13 employees
  6. #6 alxswe.com 12 employees
  7. #7 firstmail.ltd 11 employees
  8. #8 digimail.in 10 employees
  9. #9 santander.com.br 10 employees
  10. #10 netpnb.com 10 employees
  11. #11 rblbank.com 9 employees
  12. #12 mail.gov.in 8 employees
  13. #13 uol.com.br 8 employees
  14. #14 yandex.com.tr 8 employees
  15. #15 konsoleh.co.za 8 employees
  16. #16 aviation-links.co.il 7 employees
  17. #17 secureserver.net 7 employees
  18. #18 defencevpn.com 7 employees
  19. #19 maccabi4u.co.il 7 employees
  20. #20 fednetbank.com 7 employees
  21. #21 unionbankonline.co.in 7 employees
  22. #22 amen.pt 7 employees
  23. #23 icai.org 7 employees
  24. #24 deped.gov.ph 7 employees
  25. #25 sapo.pt 7 employees

Fortune 500 Exposure

Top S&P companies hit this week

Top S&P companies with compromised employees and customers detected this week.

Compromised employees

  1. #1 microsoft.com 3 employees
  2. #2 fedex.com 2 employees
  3. #3 qualcomm.com 2 employees
  4. #4 xerox.com 2 employees
  5. #5 att.com 2 employees
  6. #6 rockwellautomation.com 1 employees
  7. #7 hp.com 1 employees
  8. #8 oracle.com 1 employees
  9. #9 jpmorganchase.com 1 employees
  10. #10 aig.com 1 employees

Compromised users

  1. #1 google.com 3,071 users
  2. #2 facebook.com 2,656 users
  3. #3 netflix.com 1,345 users
  4. #4 amazon.com 1,164 users
  5. #5 paypal.com 945 users
  6. #6 apple.com 901 users
  7. #7 ebay.com 206 users
  8. #8 oracle.com 162 users
  9. #9 hp.com 148 users
  10. #10 microsoft.com 103 users
  11. #11 nike.com 96 users
  12. #12 cisco.com 95 users
  13. #13 ibm.com 58 users
  14. #14 intel.com 49 users
  15. #15 walmart.com 38 users
  16. #16 ups.com 37 users
  17. #17 westernunion.com 27 users
  18. #18 fedex.com 22 users
  19. #19 adp.com 20 users
  20. #20 bestbuy.com 20 users

Compromised Mobile Apps

Top Android apps found in infected caches

The Android applications most frequently found in infected device caches this week.

Top 20
#1

Facebook

facebook.com · com.facebook.katana

1,374 users

#2

Instagram

instagram.com · com.instagram.android

1,073 users

#3

Netflix

netflix.com · com.netflix.mediaclient

986 users

#4

Pinterest

pinterest.com · com.pinterest

694 users

#5

Spotify

spotify.com · com.spotify.music

661 users

#6

Discord

discord.com · com.discord

622 users

#7

Roblox

roblox.com · com.roblox.client

581 users

#8

Twitter

twitter.com · com.twitter.android

434 users

#9

Twitch

app.com · tv.twitch.android.app

427 users

#10

Snapchat

snapchat.com · com.snapchat.android

409 users

#11

Wish

contextlogic.com · com.contextlogic.wish

292 users

#12

PayPal

paypal.com · com.paypal.android.p2pmobile

235 users

#13

Zoom

videomeetings.com · us.zoom.videomeetings

233 users

#14

Mega

app.com · mega.privacy.android.app

205 users

#15

LinkedIn

linkedin.com · com.linkedin.android

198 users

#16

Xiaomi

xiaomi.com · com.xiaomi.account

195 users

#17

Mercadolibre

mercadolibre.com · com.mercadolibre

193 users

#18

Alibaba

alibaba.com · com.alibaba.aliexpresshd

174 users

#19

Disney

disney.com · com.disney.disneyplus

171 users

#20

Waze

waze.com · com.waze

170 users

Top Compromised Email Providers

Email domains tied to compromised credentials

Gmail, hotmail, and beyond — providers seen across this week's stealer logs.

Top 25
  1. #1 gmail.com 166,819 users
  2. #2 hotmail.com 12,830 users
  3. #3 yahoo.com 9,954 users
  4. #4 outlook.com 4,783 users
  5. #5 live.com 953 users
  6. #6 icloud.com 931 users
  7. #7 yahoo.com.br 765 users
  8. #8 hotmail.fr 525 users
  9. #9 ymail.com 351 users
  10. #10 msn.com 325 users
  11. #11 yahoo.fr 324 users
  12. #12 yahoo.it 261 users
  13. #13 yandex.com 239 users
  14. #14 yahoo.co.id 234 users
  15. #15 hotmail.com.ar 225 users
  16. #16 web.de 210 users
  17. #17 proton.me 160 users
  18. #18 googlemail.com 157 users
  19. #19 live.fr 157 users
  20. #20 libero.it 155 users
  21. #21 hotmail.co.uk 154 users
  22. #22 live.com.ar 139 users
  23. #23 aol.com 139 users
  24. #24 protonmail.com 133 users
  25. #25 gmx.com 131 users

Top Compromised Social Platforms

Where saved sessions and logins lived

Social media services where compromised accounts had stored sessions or saved logins.

Top 19
  1. #1 facebook.com 2,656 accounts
  2. #2 twitter.com 898 accounts
  3. #3 instagram.com 1,571 accounts
  4. #4 linkedin.com 828 accounts
  5. #5 pinterest.com 245 accounts
  6. #6 tiktok.com 350 accounts
  7. #7 snapchat.com 230 accounts
  8. #8 reddit.com 183 accounts
  9. #9 youtube.com 26 accounts
  10. #10 weibo.com 8 accounts
  11. #11 vk.com 111 accounts
  12. #12 telegram.org 23 accounts
  13. #13 tumblr.com 97 accounts
  14. #14 discord.com 1,215 accounts
  15. #15 flickr.com 46 accounts
  16. #16 myspace.com 7 accounts
  17. #17 badoo.com 24 accounts
  18. #18 meetup.com 8 accounts
  19. #19 quora.com 24 accounts

Malware Landscape

Stealer families & anti-virus coverage

Malware families responsible for this week's infections, and the anti-virus solutions reported by infected hosts.

Stealer Families

  1. #1 Lumma 3,439machines
  2. #2 Generic Stealer 1,191machines

Anti-virus Coverage

  1. #1 Windows Defender 2,162machines
  2. #2 Windows Defender [ON] 257machines
  3. #3 None 158machines
  4. #4 Reason Cybersecurity 71machines
  5. #5 Reason Cybersecurity [OFF] 12machines
  6. #6 IObit Malware Fighter 6machines
  7. #7 Avast Antivirus 5machines
  8. #8 Kaspersky [OFF] 4machines
  9. #9 Panda Dome [OFF] 4machines
  10. #10 Norton Security Ultra 4machines

Targeted Application Keywords

What attackers grep for

The most common application keywords seen across credential logs — auth, sso, vpn, and more.

Top 25
  1. #1 auth 17,602hits
  2. #2 sso 4,031hits
  3. #3 zoom 1,378hits
  4. #4 github 915hits
  5. #5 webmail 786hits
  6. #6 oracle 422hits
  7. #7 adfs 343hits
  8. #8 zendesk 256hits
  9. #9 sap 243hits
  10. #10 cpanel 224hits
  11. #11 vpn 210hits
  12. #12 ping 170hits
  13. #13 owa 160hits
  14. #14 kaspersky 111hits
  15. #15 sts 107hits
  16. #16 st 91hits
  17. #17 extranet 78hits
  18. #18 ftp 77hits
  19. #19 twilio 76hits
  20. #20 roundcube 74hits
  21. #21 webex 64hits
  22. #22 imap 58hits
  23. #23 gitlab 47hits
  24. #24 okta 47hits
  25. #25 citrix 39hits

Cavalier · Continuous monitoring

Get this depth of insight on your own organization.

Cavalier turns this same intelligence into a continuous real-time feed of compromised employees, customers and third-party vendors for your business.

Get a free report Explore Cavalier →

More reports

Previous weekly briefings

View archive →
Aug 3 → Aug 10, 2026 13 min

Infostealers Weekly Report: 2026-08-03 – 2026-08-10

  • 38K machines
  • 8K users
  • 407K domains
View report →
Jul 27 → Aug 3, 2026 14 min

Infostealers Weekly Report: 2026-07-27 – 2026-08-03

  • 34K machines
  • 10K users
  • 380K domains
View report →
Jul 20 → Jul 27, 2026 14 min

Infostealers Weekly Report: 2026-07-20 – 2026-07-27

  • 41K machines
  • 10K users
  • 429K domains
View report →
Free Tools Check your exposure