Skip to content
INFOSTEALERS By HudsonRock
Threat feeds weekly Sep 7 – Sep 14, 2026 1 min read

Threat Feeds Weekly Report: 2026-09-07 – 2026-09-14

Threat Feeds Weekly Report — executive summary of Hudson Rock Cavalier threat intelligence feeds. This report covers aggregated statistics only: C2 infrastructure, PhaaS kit hosts, and ClickFix monitor activity for Sep 7 – Sep 14, 2026 (UTC).

#1 37,160 Total Feed Sightings
#2 101 Countries Observed
#3 30,500 C2 Host Sightings
#4 2,018 PhaaS Host Sightings
#5 128,971 ClickFix Sites

C2 Intelligence Feed

Infostealer command & control

Host sightings, stealer families and geography over the last 8 days (UTC).

30,500 hosts
30,500Host Sightings
41Distinct Families
101Countries Observed

Daily Volume

  1. Sep 76,052
  2. Sep 83,293
  3. Sep 94,726
  4. Sep 105,143
  5. Sep 113,658
  6. Sep 122,190
  7. Sep 134,448
  8. Sep 14990

Top Stealer Families

  1. #1socgholish2,824hosts
  2. #2stealc693hosts
  3. #3remus477hosts
  4. #4vidar444hosts
  5. #5lumma305hosts
  6. #6amos261hosts
  7. #7macsync254hosts
  8. #8salatstealer147hosts
  9. #9redline139hosts
  10. #10agenttesla130hosts

Top Countries

  1. #1US13,005hosts
  2. #2DE3,088hosts
  3. #3FR2,201hosts
  4. #4BR932hosts
  5. #5IT862hosts
  6. #6GB811hosts
  7. #7IN686hosts
  8. #8NL629hosts
  9. #9RU581hosts
  10. #10ES496hosts

PhaaS Feed

Phishing-as-a-Service kits

Active kit hosts and geographic distribution over the last 8 days (UTC).

2,018 hosts
2,018Host Sightings
36Distinct Kits
44Countries Observed

Daily Volume

  1. Sep 7157
  2. Sep 8193
  3. Sep 9330
  4. Sep 10593
  5. Sep 11287
  6. Sep 12226
  7. Sep 13166
  8. Sep 1466

Top Phishing Kits

  1. #1sessionserpent281hosts
  2. #2eviltokens99hosts
  3. #3legokit79hosts
  4. #4kali36551hosts
  5. #5gcore27hosts
  6. #6evilginx24hosts
  7. #7smartapesg12hosts
  8. #8n0va11hosts
  9. #9miarroba10hosts
  10. #10shadowpad9hosts

Top Countries

  1. #1US1,146hosts
  2. #2GB174hosts
  3. #3FI131hosts
  4. #4DE39hosts
  5. #5JP34hosts
  6. #6SG31hosts
  7. #7NL31hosts
  8. #8FR21hosts
  9. #9HK14hosts
  10. #10RU12hosts

ClickFix Monitor

Fake CAPTCHA & clipboard hijacks

Tracked ClickFix sites across the Cavalier monitor — malicious flags, clipboard theft and fake CAPTCHAs.

128,971 sites
128,971Total Sites
4,642Malicious Flagged
4,642Clipboard Hijacked
1,283Fake CAPTCHA

7-Day Volume

  1. Sep 75,560
  2. Sep 83,113
  3. Sep 94,333
  4. Sep 104,740
  5. Sep 113,242
  6. Sep 121,894
  7. Sep 133,944
  8. Sep 14801

Top Countries

  1. #1US11,582sites
  2. #2DE2,886sites
  3. #3FR2,130sites
  4. #4BR912sites
  5. #5IT842sites
  6. #6GB781sites
  7. #7IN673sites
  8. #8NL536sites
  9. #9RU513sites
  10. #10ES482sites

Top Technologies

  1. #1hosting26,388sites
  2. #2isp994sites
  3. #3education30sites
  4. #4business17sites
  5. #5government15sites

Weekly Briefing

Join 20,000+ cybersecurity pros for the briefing.

Weekly infostealer updates, top compromised domains, trending stealer families and curated research from the Hudson Rock team. No fluff, no noise.

  • Weekly issue
  • Zero spam
  • Actionable intel
  • Unsubscribe anytime

Powered by Hudson Rock · By subscribing, you agree to our privacy policy. Unsubscribe anytime.

More threat feeds

Previous weekly summaries

View archive →
Free Tools Check your exposure