Skip to content
INFOSTEALERS By HudsonRock
Weekly intelligence Nov 2 – Nov 9, 2026 12 min read

Infostealers Weekly Report: 2026-11-02 – 2026-11-09

InfoStealers Weekly Report - In this comprehensive report, we provide you with valuable insights into the most pressing threats facing organizations today. As cyberattacks continue to grow in complexity and scale, our mission is to equip you with the knowledge and tools needed to safeguard your sensitive information. Join us as we analyze the top compromised domains, identify trends in compromised employees and users, and examine the global impact of InfoStealer infections. Stay informed, stay protected, and stay one step ahead of cyber threats with our weekly report and info-stealers statistics.

#1 12,382 Compromised Machines
#2 2,221 Compromised Employees
#3 2,896 Compromised Users
#4 7,265 Compromised Androids
#5 78,041 Compromised Domains
Check if you are exposed All reports →

Threat Geography

Where infections came from

Compromised machines distributed by country of infection — hover any region to inspect.

Top 25 of 147
Infections by country

Top 25 countries

  1. #1 India 3,068
  2. #2 Pakistan 520
  3. #3 Vietnam 414
  4. #4 Bangladesh 394
  5. #5 Brazil 234
  6. #6 Philippines 153
  7. #7 Nepal 111
  8. #8 Sri Lanka 97
  9. #9 Kenya 95
  10. #10 Tanzania 95
  11. #11 Nigeria 93
  12. #12 Morocco 87
  13. #13 Algeria 84
  14. #14 United States of America 84
  15. #15 Uganda 75
  16. #16 Ghana 72
  17. #17 South Africa 68
  18. #18 Peru 66
  19. #19 Indonesia 60
  20. #20 Thailand 57
  21. #21 Colombia 57
  22. #22 Malaysia 47
  23. #23 Iraq 43
  24. #24 Argentina 35
  25. #25 Turkey 32

Top Compromised Domains

Where users had active sessions

Domains where infected users had active sessions and saved credentials at the time of infection.

Top 25
  1. #1 google.com 8,930 users
  2. #2 facebook.com 5,957 users
  3. #3 live.com 4,613 users
  4. #4 instagram.com 4,566 users
  5. #5 com.facebook.katana 3,778 users
  6. #6 com.instagram.android 3,424 users
  7. #7 amazon.com 2,478 users
  8. #8 netflix.com 2,294 users
  9. #9 amazon.in 2,188 users
  10. #10 com.netflix.mediaclient 2,089 users
  11. #11 discord.com 1,944 users
  12. #12 linkedin.com 1,916 users
  13. #13 microsoftonline.com 1,904 users
  14. #14 com.snapchat.android 1,891 users
  15. #15 openai.com 1,830 users
  16. #16 com.pinterest 1,410 users
  17. #17 twitter.com 1,265 users
  18. #18 zoom.us 1,247 users
  19. #19 roblox.com 1,208 users
  20. #20 com.discord 1,192 users
  21. #21 irctc.co.in 1,171 users
  22. #22 github.com 1,159 users
  23. #23 paypal.com 1,100 users
  24. #24 com.spotify.music 1,096 users
  25. #25 com.roblox.client 1,076 users

Top Compromised Corporate Domains

Employees caught in the logs

Domains where compromised users were employees, surfaced via business email and credentials.

Top 25
  1. #1 hostinger.com 110 employees
  2. #2 rediff.com 107 employees
  3. #3 icicibank.com 104 employees
  4. #4 unionbankonline.co.in 59 employees
  5. #5 icai.org 51 employees
  6. #6 netpnb.com 31 employees
  7. #7 accenture.com 30 employees
  8. #8 bobibanking.com 29 employees
  9. #9 pnbibanking.in 25 employees
  10. #10 sts.net.pk 25 employees
  11. #11 unionbankonline.bank.in 22 employees
  12. #12 digimail.in 22 employees
  13. #13 bankofbaroda.bank.in 19 employees
  14. #14 mail.gov.in 19 employees
  15. #15 njoyn.com 19 employees
  16. #16 onlinesbi.com 18 employees
  17. #17 adamasuniversity.ac.in 17 employees
  18. #18 ecp.gov.pk 17 employees
  19. #19 santander.com.br 16 employees
  20. #20 pnb.bank.in 16 employees
  21. #21 karnataka.gov.in 15 employees
  22. #22 jio.com 14 employees
  23. #23 zoho.in 14 employees
  24. #24 onlinesbi.sbi 13 employees
  25. #25 dimensiondata.com 13 employees

Fortune 500 Exposure

Top S&P companies hit this week

Top S&P companies with compromised employees and customers detected this week.

Compromised employees

  1. #1 salesforce.com 12 employees
  2. #2 ibm.com 5 employees
  3. #3 microsoft.com 5 employees
  4. #4 ebay.com 5 employees
  5. #5 ge.com 4 employees
  6. #6 cognizant.com 4 employees
  7. #7 google.com 3 employees
  8. #8 amazon.com 3 employees
  9. #9 ajg.com 2 employees
  10. #10 firstam.com 2 employees
  11. #11 johndeere.com 1 employees
  12. #12 rockwellautomation.com 1 employees
  13. #13 jpmorganchase.com 1 employees
  14. #14 autozone.com 1 employees
  15. #15 abbott.com 1 employees
  16. #16 paypal.com 1 employees

Compromised users

  1. #1 google.com 8,930 users
  2. #2 facebook.com 5,957 users
  3. #3 amazon.com 2,478 users
  4. #4 netflix.com 2,294 users
  5. #5 paypal.com 1,100 users
  6. #6 apple.com 1,030 users
  7. #7 oracle.com 321 users
  8. #8 hp.com 265 users
  9. #9 microsoft.com 227 users
  10. #10 ibm.com 184 users
  11. #11 cisco.com 166 users
  12. #12 ebay.com 121 users
  13. #13 nike.com 119 users
  14. #14 salesforce.com 106 users
  15. #15 intel.com 50 users
  16. #16 westernunion.com 46 users
  17. #17 broadcom.com 39 users
  18. #18 walmart.com 38 users
  19. #19 marriott.com 34 users
  20. #20 adp.com 33 users

Compromised Mobile Apps

Top Android apps found in infected caches

The Android applications most frequently found in infected device caches this week.

Top 20
#1

Facebook

facebook.com · com.facebook.katana

3,778 users

#2

Instagram

instagram.com · com.instagram.android

3,424 users

#3

Netflix

netflix.com · com.netflix.mediaclient

2,089 users

#4

Snapchat

snapchat.com · com.snapchat.android

1,891 users

#5

Pinterest

pinterest.com · com.pinterest

1,410 users

#6

Discord

discord.com · com.discord

1,192 users

#7

Spotify

spotify.com · com.spotify.music

1,096 users

#8

Roblox

roblox.com · com.roblox.client

1,076 users

#9

Twitter

twitter.com · com.twitter.android

941 users

#10

Zoom

videomeetings.com · us.zoom.videomeetings

847 users

#11

LinkedIn

linkedin.com · com.linkedin.android

735 users

#12

Xiaomi

xiaomi.com · com.xiaomi.account

575 users

#13

PayPal

paypal.com · com.paypal.android.p2pmobile

453 users

#14

Wish

contextlogic.com · com.contextlogic.wish

314 users

#15

Twitch

app.com · tv.twitch.android.app

264 users

#16

Mega

app.com · mega.privacy.android.app

263 users

#17

Alibaba

alibaba.com · com.alibaba.aliexpresshd

133 users

#18

Waze

waze.com · com.waze

97 users

#19

Mercadolibre

mercadolibre.com · com.mercadolibre

96 users

#20

Disney

disney.com · com.disney.disneyplus

96 users

Top Compromised Email Providers

Email domains tied to compromised credentials

Gmail, hotmail, and beyond — providers seen across this week's stealer logs.

Top 25
  1. #1 gmail.com 299,359 users
  2. #2 hotmail.com 9,858 users
  3. #3 yahoo.com 7,055 users
  4. #4 outlook.com 4,621 users
  5. #5 icloud.com 743 users
  6. #6 ymail.com 467 users
  7. #7 yahoo.co.uk 440 users
  8. #8 yahoo.com.br 416 users
  9. #9 yahoo.fr 348 users
  10. #10 yahoo.co.in 286 users
  11. #11 yahoo.com.sg 246 users
  12. #12 email.com 240 users
  13. #13 live.com 192 users
  14. #14 outlook.com.br 187 users
  15. #15 hotmail.it 165 users
  16. #16 yandex.com 165 users
  17. #17 mail.com 160 users
  18. #18 yahoo.com.ph 126 users
  19. #19 libero.it 105 users
  20. #20 aol.com 92 users
  21. #21 protonmail.com 89 users
  22. #22 proton.me 88 users
  23. #23 hotmail.co.uk 77 users
  24. #24 facebook.com 67 users
  25. #25 live.fr 63 users

Top Compromised Social Platforms

Where saved sessions and logins lived

Social media services where compromised accounts had stored sessions or saved logins.

Top 19
  1. #1 facebook.com 5,973 accounts
  2. #2 twitter.com 1,265 accounts
  3. #3 instagram.com 4,566 accounts
  4. #4 linkedin.com 1,916 accounts
  5. #5 pinterest.com 807 accounts
  6. #6 tiktok.com 838 accounts
  7. #7 snapchat.com 831 accounts
  8. #8 reddit.com 209 accounts
  9. #9 youtube.com 26 accounts
  10. #10 weibo.com 5 accounts
  11. #11 vk.com 212 accounts
  12. #12 telegram.org 95 accounts
  13. #13 tumblr.com 54 accounts
  14. #14 discord.com 1,944 accounts
  15. #15 flickr.com 75 accounts
  16. #16 myspace.com 18 accounts
  17. #17 badoo.com 13 accounts
  18. #18 meetup.com 15 accounts
  19. #19 quora.com 69 accounts

Malware Landscape

Stealer families & anti-virus coverage

Malware families responsible for this week's infections, and the anti-virus solutions reported by infected hosts.

Stealer Families

  1. #1 Generic Stealer 12,218machines
  2. #2 Lumma 136machines
  3. #3 Warden Stealer 4machines
  4. #4 Vidar 1machines

Anti-virus Coverage

  1. #1 Windows Defender 9,775machines
  2. #2 None 1,258machines
  3. #3 WindowsDefender 377machines
  4. #4 Malwarebytes 74machines
  5. #5 Avast 72machines
  6. #6 None detected 64machines
  7. #7 Kaspersky 61machines
  8. #8 Avast, Norton 50machines
  9. #9 ESET 12machines
  10. #10 Trend Micro 5machines

Targeted Application Keywords

What attackers grep for

The most common application keywords seen across credential logs — auth, sso, vpn, and more.

Top 25
  1. #1 auth 30,875hits
  2. #2 sso 7,032hits
  3. #3 zoom 2,825hits
  4. #4 github 2,006hits
  5. #5 sap 1,082hits
  6. #6 salesforce 866hits
  7. #7 adfs 746hits
  8. #8 oracle 652hits
  9. #9 zendesk 393hits
  10. #10 sts 393hits
  11. #11 webmail 312hits
  12. #12 vpn 306hits
  13. #13 ping 298hits
  14. #14 owa 191hits
  15. #15 webex 172hits
  16. #16 okta 151hits
  17. #17 cpanel 95hits
  18. #18 st 89hits
  19. #19 kaspersky 77hits
  20. #20 ftp 76hits
  21. #21 twilio 76hits
  22. #22 extranet 65hits
  23. #23 roundcube 57hits
  24. #24 gitlab 41hits
  25. #25 sharepoint 31hits

Cavalier · Continuous monitoring

Get this depth of insight on your own organization.

Cavalier turns this same intelligence into a continuous real-time feed of compromised employees, customers and third-party vendors for your business.

Get a free report Explore Cavalier →

More reports

Previous weekly briefings

View archive →
Oct 26 → Nov 2, 2026 13 min

Infostealers Weekly Report: 2026-10-26 – 2026-11-02

  • 26K machines
  • 6K users
  • 270K domains
View report →
Oct 19 → Oct 26, 2026 13 min

Infostealers Weekly Report: 2026-10-19 – 2026-10-26

  • 28K machines
  • 6K users
  • 361K domains
View report →
Oct 12 → Oct 19, 2026 14 min

Infostealers Weekly Report: 2026-10-12 – 2026-10-19

  • 35K machines
  • 11K users
  • 388K domains
View report →
Free Tools Check your exposure