Skip to content
INFOSTEALERS By HudsonRock
Weekly intelligence Sep 14 – Sep 21, 2026 13 min read

Infostealers Weekly Report: 2026-09-14 – 2026-09-21

InfoStealers Weekly Report - In this comprehensive report, we provide you with valuable insights into the most pressing threats facing organizations today. As cyberattacks continue to grow in complexity and scale, our mission is to equip you with the knowledge and tools needed to safeguard your sensitive information. Join us as we analyze the top compromised domains, identify trends in compromised employees and users, and examine the global impact of InfoStealer infections. Stay informed, stay protected, and stay one step ahead of cyber threats with our weekly report and info-stealers statistics.

#1 20,935 Compromised Machines
#2 4,579 Compromised Employees
#3 5,412 Compromised Users
#4 10,944 Compromised Androids
#5 282,919 Compromised Domains
Check if you are exposed All reports →

Threat Geography

Where infections came from

Compromised machines distributed by country of infection — hover any region to inspect.

Top 25 of 158
Infections by country

Top 25 countries

  1. #1 India 4,683
  2. #2 United States of America 810
  3. #3 Philippines 624
  4. #4 Bangladesh 551
  5. #5 Brazil 455
  6. #6 France 452
  7. #7 Indonesia 363
  8. #8 Turkey 340
  9. #9 Egypt 333
  10. #10 Vietnam 297
  11. #11 Unknown Region 189
  12. #12 Pakistan 180
  13. #13 Mexico 160
  14. #14 China 154
  15. #15 Argentina 145
  16. #16 Morocco 142
  17. #17 Colombia 134
  18. #18 Germany 129
  19. #19 South Africa 125
  20. #20 Malaysia 125
  21. #21 Peru 125
  22. #22 Nepal 120
  23. #23 United Kingdom 116
  24. #24 Sri Lanka 113
  25. #25 Japan 111

Top Compromised Domains

Where users had active sessions

Domains where infected users had active sessions and saved credentials at the time of infection.

Top 25
  1. #1 google.com 14,196 users
  2. #2 facebook.com 9,874 users
  3. #3 live.com 8,663 users
  4. #4 instagram.com 7,522 users
  5. #5 com.facebook.katana 5,584 users
  6. #6 com.instagram.android 5,076 users
  7. #7 discord.com 4,921 users
  8. #8 netflix.com 4,794 users
  9. #9 amazon.com 4,730 users
  10. #10 microsoftonline.com 3,963 users
  11. #11 roblox.com 3,903 users
  12. #12 com.netflix.mediaclient 3,409 users
  13. #13 steampowered.com 3,211 users
  14. #14 linkedin.com 3,187 users
  15. #15 openai.com 3,025 users
  16. #16 apple.com 3,007 users
  17. #17 paypal.com 2,974 users
  18. #18 twitter.com 2,910 users
  19. #19 amazon.in 2,838 users
  20. #20 spotify.com 2,602 users
  21. #21 com.roblox.client 2,592 users
  22. #22 com.snapchat.android 2,465 users
  23. #23 com.discord 2,455 users
  24. #24 github.com 2,433 users
  25. #25 com.spotify.music 2,375 users

Top Compromised Corporate Domains

Employees caught in the logs

Domains where compromised users were employees, surfaced via business email and credentials.

Top 25
  1. #1 icicibank.com 230 employees
  2. #2 hostinger.com 166 employees
  3. #3 rediff.com 158 employees
  4. #4 winandoffice.com 134 employees
  5. #5 aruba.it 123 employees
  6. #6 android 98 employees
  7. #7 bobibanking.com 76 employees
  8. #8 icai.org 72 employees
  9. #9 mail.gov.in 67 employees
  10. #10 netpnb.com 67 employees
  11. #11 firstmail.ltd 60 employees
  12. #12 unionbankonline.co.in 56 employees
  13. #13 apc.org 56 employees
  14. #14 karnataka.gov.in 55 employees
  15. #15 utm.edu.ec 51 employees
  16. #16 pec.it 50 employees
  17. #17 mak.ac.ug 48 employees
  18. #18 web-hosting.com 43 employees
  19. #19 indusind.com 43 employees
  20. #20 tim.it 39 employees
  21. #21 pnbibanking.in 35 employees
  22. #22 amu.ac.in 34 employees
  23. #23 secureserver.net 34 employees
  24. #24 163.com 33 employees
  25. #25 banquemisr.com 32 employees

Fortune 500 Exposure

Top S&P companies hit this week

Top S&P companies with compromised employees and customers detected this week.

Compromised employees

  1. #1 salesforce.com 14 employees
  2. #2 rockwellautomation.com 9 employees
  3. #3 microsoft.com 9 employees
  4. #4 oracle.com 6 employees
  5. #5 ups.com 4 employees
  6. #6 ibm.com 4 employees
  7. #7 xerox.com 4 employees
  8. #8 cognizant.com 3 employees
  9. #9 netflix.com 3 employees
  10. #10 hp.com 2 employees
  11. #11 southwest.com 2 employees
  12. #12 amazon.com 2 employees
  13. #13 publix.com 2 employees
  14. #14 pg.com 2 employees
  15. #15 group1auto.com 1 employees
  16. #16 bestbuy.com 1 employees
  17. #17 facebook.com 1 employees
  18. #18 jacobs.com 1 employees
  19. #19 fisglobal.com 1 employees
  20. #20 charter.com 1 employees

Compromised users

  1. #1 google.com 14,196 users
  2. #2 facebook.com 9,874 users
  3. #3 netflix.com 4,794 users
  4. #4 amazon.com 4,730 users
  5. #5 apple.com 3,007 users
  6. #6 paypal.com 2,974 users
  7. #7 hp.com 763 users
  8. #8 oracle.com 725 users
  9. #9 ebay.com 616 users
  10. #10 microsoft.com 542 users
  11. #11 nike.com 420 users
  12. #12 cisco.com 398 users
  13. #13 ibm.com 359 users
  14. #14 walmart.com 288 users
  15. #15 ups.com 261 users
  16. #16 westernunion.com 193 users
  17. #17 adp.com 164 users
  18. #18 salesforce.com 151 users
  19. #19 fedex.com 148 users
  20. #20 capitalone.com 142 users

Compromised Mobile Apps

Top Android apps found in infected caches

The Android applications most frequently found in infected device caches this week.

Top 20
#1

Facebook

facebook.com · com.facebook.katana

5,584 users

#2

Instagram

instagram.com · com.instagram.android

5,076 users

#3

Netflix

netflix.com · com.netflix.mediaclient

3,409 users

#4

Roblox

roblox.com · com.roblox.client

2,592 users

#5

Snapchat

snapchat.com · com.snapchat.android

2,465 users

#6

Discord

discord.com · com.discord

2,455 users

#7

Spotify

spotify.com · com.spotify.music

2,375 users

#8

Pinterest

pinterest.com · com.pinterest

2,302 users

#9

Twitter

twitter.com · com.twitter.android

1,605 users

#10

Twitch

app.com · tv.twitch.android.app

1,249 users

#11

Zoom

videomeetings.com · us.zoom.videomeetings

1,151 users

#12

LinkedIn

linkedin.com · com.linkedin.android

1,009 users

#13

PayPal

paypal.com · com.paypal.android.p2pmobile

980 users

#14

Xiaomi

xiaomi.com · com.xiaomi.account

866 users

#15

Wish

contextlogic.com · com.contextlogic.wish

842 users

#16

Mega

app.com · mega.privacy.android.app

784 users

#17

Disney

disney.com · com.disney.disneyplus

625 users

#18

Alibaba

alibaba.com · com.alibaba.aliexpresshd

359 users

#19

Waze

waze.com · com.waze

319 users

#20

Mercadolibre

mercadolibre.com · com.mercadolibre

313 users

Top Compromised Email Providers

Email domains tied to compromised credentials

Gmail, hotmail, and beyond — providers seen across this week's stealer logs.

Top 25
  1. #1 gmail.com 743,982 users
  2. #2 hotmail.com 56,551 users
  3. #3 yahoo.com 24,318 users
  4. #4 outlook.com 13,495 users
  5. #5 hotmail.fr 5,834 users
  6. #6 icloud.com 4,331 users
  7. #7 ymail.com 3,227 users
  8. #8 free.fr 2,194 users
  9. #9 msn.com 2,011 users
  10. #10 yahoo.fr 1,704 users
  11. #11 live.fr 1,701 users
  12. #12 live.com 1,676 users
  13. #13 gmx.net 1,626 users
  14. #14 yahoo.com.br 1,352 users
  15. #15 hotmail.es 1,322 users
  16. #16 orange.fr 1,130 users
  17. #17 libero.it 1,095 users
  18. #18 aol.com 1,073 users
  19. #19 hotmail.it 1,050 users
  20. #20 laposte.net 975 users
  21. #21 live.co.uk 781 users
  22. #22 yahoo.co.uk 762 users
  23. #23 sfr.fr 752 users
  24. #24 proton.me 743 users
  25. #25 live.it 731 users

Top Compromised Social Platforms

Where saved sessions and logins lived

Social media services where compromised accounts had stored sessions or saved logins.

Top 19
  1. #1 facebook.com 9,874 accounts
  2. #2 twitter.com 2,910 accounts
  3. #3 instagram.com 7,522 accounts
  4. #4 linkedin.com 3,187 accounts
  5. #5 pinterest.com 1,361 accounts
  6. #6 tiktok.com 1,639 accounts
  7. #7 snapchat.com 1,455 accounts
  8. #8 reddit.com 635 accounts
  9. #9 youtube.com 77 accounts
  10. #10 weibo.com 38 accounts
  11. #11 vk.com 504 accounts
  12. #12 telegram.org 153 accounts
  13. #13 tumblr.com 332 accounts
  14. #14 discord.com 4,921 accounts
  15. #15 flickr.com 205 accounts
  16. #16 myspace.com 52 accounts
  17. #17 badoo.com 89 accounts
  18. #18 meetup.com 26 accounts
  19. #19 quora.com 138 accounts

Malware Landscape

Stealer families & anti-virus coverage

Malware families responsible for this week's infections, and the anti-virus solutions reported by infected hosts.

Stealer Families

  1. #1 Generic Stealer 19,019machines
  2. #2 Lumma 1,392machines
  3. #3 Acreed 522machines
  4. #4 Remus 2machines

Anti-virus Coverage

  1. #1 Windows Defender 9,652machines
  2. #2 WindowsDefender 1,092machines
  3. #3 None 970machines
  4. #4 Avast 136machines
  5. #5 Malwarebytes 112machines
  6. #6 Avast, Norton 47machines
  7. #7 ReasonCybersecurity 43machines
  8. #8 Kaspersky 42machines
  9. #9 McAfee 38machines
  10. #10 AvastAntivirus 30machines

Targeted Application Keywords

What attackers grep for

The most common application keywords seen across credential logs — auth, sso, vpn, and more.

Top 25
  1. #1 auth 85,685hits
  2. #2 sso 22,689hits
  3. #3 zoom 5,752hits
  4. #4 github 4,825hits
  5. #5 webmail 2,149hits
  6. #6 adfs 1,841hits
  7. #7 oracle 1,786hits
  8. #8 salesforce 1,579hits
  9. #9 sap 1,518hits
  10. #10 owa 900hits
  11. #11 ping 896hits
  12. #12 zendesk 887hits
  13. #13 sts 812hits
  14. #14 vpn 731hits
  15. #15 cpanel 570hits
  16. #16 ftp 536hits
  17. #17 okta 417hits
  18. #18 kaspersky 412hits
  19. #19 webex 379hits
  20. #20 extranet 350hits
  21. #21 roundcube 315hits
  22. #22 st 299hits
  23. #23 gitlab 214hits
  24. #24 twilio 207hits
  25. #25 git 189hits

Cavalier · Continuous monitoring

Get this depth of insight on your own organization.

Cavalier turns this same intelligence into a continuous real-time feed of compromised employees, customers and third-party vendors for your business.

Get a free report Explore Cavalier →

More reports

Previous weekly briefings

View archive →
Sep 7 → Sep 14, 2026 13 min

Infostealers Weekly Report: 2026-09-07 – 2026-09-14

  • 30K machines
  • 8K users
  • 327K domains
View report →
Aug 31 → Sep 7, 2026 13 min

Infostealers Weekly Report: 2026-08-31 – 2026-09-07

  • 19K machines
  • 6K users
  • 220K domains
View report →
Aug 24 → Aug 31, 2026 12 min

Infostealers Weekly Report: 2026-08-24 – 2026-08-31

  • 13K machines
  • 6K users
  • 83K domains
View report →
Free Tools Check your exposure