Skip to content
INFOSTEALERS By HudsonRock
Threat feeds weekly Sep 14 – Sep 21, 2026 1 min read

Threat Feeds Weekly Report: 2026-09-14 – 2026-09-21

Threat Feeds Weekly Report — executive summary of Hudson Rock Cavalier threat intelligence feeds. This report covers aggregated statistics only: C2 infrastructure, PhaaS kit hosts, and ClickFix monitor activity for Sep 14 – Sep 21, 2026 (UTC).

#1 31,499 Total Feed Sightings
#2 88 Countries Observed
#3 24,447 C2 Host Sightings
#4 2,380 PhaaS Host Sightings
#5 150,033 ClickFix Sites

C2 Intelligence Feed

Infostealer command & control

Host sightings, stealer families and geography over the last 8 days (UTC).

24,447 hosts
24,447Host Sightings
33Distinct Families
88Countries Observed

Daily Volume

  1. Sep 143,395
  2. Sep 154,569
  3. Sep 162,549
  4. Sep 175,009
  5. Sep 184,979
  6. Sep 191,666
  7. Sep 201,621
  8. Sep 21659

Top Stealer Families

  1. #1socgholish1,709hosts
  2. #2stealc791hosts
  3. #3remus429hosts
  4. #4vidar419hosts
  5. #5lumma208hosts
  6. #6santastealer155hosts
  7. #7agenttesla145hosts
  8. #8redline111hosts
  9. #9salatstealer109hosts
  10. #10phantomstealer78hosts

Top Countries

  1. #1US11,245hosts
  2. #2DE2,364hosts
  3. #3FR1,543hosts
  4. #4BR808hosts
  5. #5IN618hosts
  6. #6GB596hosts
  7. #7IT548hosts
  8. #8NL544hosts
  9. #9SG361hosts
  10. #10ES347hosts

PhaaS Feed

Phishing-as-a-Service kits

Active kit hosts and geographic distribution over the last 8 days (UTC).

2,380 hosts
2,380Host Sightings
51Distinct Kits
45Countries Observed

Daily Volume

  1. Sep 14337
  2. Sep 15194
  3. Sep 16400
  4. Sep 17283
  5. Sep 18468
  6. Sep 19289
  7. Sep 20264
  8. Sep 21145

Top Phishing Kits

  1. #1sessionserpent400hosts
  2. #2remcos98hosts
  3. #3m0yv96hosts
  4. #4legokit94hosts
  5. #5kali36563hosts
  6. #6asyncrat40hosts
  7. #7gcore39hosts
  8. #8nakedpages25hosts
  9. #9miarroba21hosts
  10. #10kremlin17hosts

Top Countries

  1. #1US1,517hosts
  2. #2FI151hosts
  3. #3SG120hosts
  4. #4GB86hosts
  5. #5DE66hosts
  6. #6NL39hosts
  7. #7RU33hosts
  8. #8CH32hosts
  9. #9FR31hosts
  10. #10JP27hosts

ClickFix Monitor

Fake CAPTCHA & clipboard hijacks

Tracked ClickFix sites across the Cavalier monitor — malicious flags, clipboard theft and fake CAPTCHAs.

150,033 sites
150,033Total Sites
4,672Malicious Flagged
4,672Clipboard Hijacked
1,300Fake CAPTCHA

7-Day Volume

  1. Sep 142,973
  2. Sep 154,232
  3. Sep 162,230
  4. Sep 174,553
  5. Sep 184,623
  6. Sep 191,422
  7. Sep 201,338
  8. Sep 21490

Top Countries

  1. #1US10,081sites
  2. #2DE2,173sites
  3. #3FR1,498sites
  4. #4BR790sites
  5. #5IN610sites
  6. #6GB577sites
  7. #7IT541sites
  8. #8NL427sites
  9. #9SG356sites
  10. #10ES346sites

Top Technologies

  1. #1hosting20,783sites
  2. #2isp736sites
  3. #3education34sites
  4. #4government11sites
  5. #5business5sites

Weekly Briefing

Join 20,000+ cybersecurity pros for the briefing.

Weekly infostealer updates, top compromised domains, trending stealer families and curated research from the Hudson Rock team. No fluff, no noise.

  • Weekly issue
  • Zero spam
  • Actionable intel
  • Unsubscribe anytime

Powered by Hudson Rock · By subscribing, you agree to our privacy policy. Unsubscribe anytime.

More threat feeds

Previous weekly summaries

View archive →
Free Tools Check your exposure