Skip to content
INFOSTEALERS By HudsonRock
Threat feeds weekly Sep 28 – Oct 5, 2026 1 min read

Threat Feeds Weekly Report: 2026-09-28 – 2026-10-05

Threat Feeds Weekly Report — executive summary of Hudson Rock Cavalier threat intelligence feeds. This report covers aggregated statistics only: C2 infrastructure, PhaaS kit hosts, and ClickFix monitor activity for Sep 28 – Oct 5, 2026 (UTC).

#1 39,473 Total Feed Sightings
#2 91 Countries Observed
#3 27,933 C2 Host Sightings
#4 6,511 PhaaS Host Sightings
#5 197,666 ClickFix Sites

C2 Intelligence Feed

Infostealer command & control

Host sightings, stealer families and geography over the last 8 days (UTC).

27,933 hosts
27,933Host Sightings
25Distinct Families
91Countries Observed

Daily Volume

  1. Sep 282,585
  2. Sep 2910,966
  3. Sep 302,630
  4. Oct 12,759
  5. Oct 22,469
  6. Oct 33,826
  7. Oct 42,282
  8. Oct 5416

Top Stealer Families

  1. #1socgholish955hosts
  2. #2vidar93hosts
  3. #3remus69hosts
  4. #4salatstealer23hosts
  5. #5lumma23hosts
  6. #6svcstealer17hosts
  7. #7stealc17hosts
  8. #8cameleon14hosts
  9. #9risepro13hosts
  10. #10stealerium13hosts

Top Countries

  1. #1US13,161hosts
  2. #2DE2,613hosts
  3. #3FR2,030hosts
  4. #4BR1,090hosts
  5. #5IT996hosts
  6. #6GB780hosts
  7. #7IN666hosts
  8. #8SG479hosts
  9. #9NL465hosts
  10. #10ES441hosts

PhaaS Feed

Phishing-as-a-Service kits

Active kit hosts and geographic distribution over the last 8 days (UTC).

6,511 hosts
6,511Host Sightings
23Distinct Kits
58Countries Observed

Daily Volume

  1. Sep 28269
  2. Sep 29903
  3. Sep 30350
  4. Oct 1247
  5. Oct 23,679
  6. Oct 3328
  7. Oct 4134
  8. Oct 5601

Top Phishing Kits

  1. #1masscollect4,005hosts
  2. #2sessionserpent389hosts
  3. #3legokit97hosts
  4. #4kali36557hosts
  5. #5gcore29hosts
  6. #6gh0strat21hosts
  7. #7miarroba19hosts
  8. #8flowerstorm19hosts
  9. #9smartapesg9hosts
  10. #10n0va6hosts

Top Countries

  1. #1US1,492hosts
  2. #2DE1,083hosts
  3. #3FI1,008hosts
  4. #4NL862hosts
  5. #5RU515hosts
  6. #6HK220hosts
  7. #7LV158hosts
  8. #8PL108hosts
  9. #9FR102hosts
  10. #10SE97hosts

ClickFix Monitor

Fake CAPTCHA & clipboard hijacks

Tracked ClickFix sites across the Cavalier monitor — malicious flags, clipboard theft and fake CAPTCHAs.

197,666 sites
197,666Total Sites
5,029Malicious Flagged
5,029Clipboard Hijacked
1,439Fake CAPTCHA

7-Day Volume

  1. Sep 282,464
  2. Sep 2910,839
  3. Sep 302,530
  4. Oct 12,673
  5. Oct 22,395
  6. Oct 33,753
  7. Oct 42,251
  8. Oct 5386

Top Countries

  1. #1US12,846sites
  2. #2DE2,532sites
  3. #3FR1,992sites
  4. #4BR1,088sites
  5. #5IT988sites
  6. #6GB778sites
  7. #7IN661sites
  8. #8SG473sites
  9. #9ES440sites
  10. #10NL420sites

Top Technologies

  1. #1hosting26,007sites
  2. #2isp1,043sites
  3. #3education45sites
  4. #4business10sites
  5. #5government6sites

Weekly Briefing

Join 20,000+ cybersecurity pros for the briefing.

Weekly infostealer updates, top compromised domains, trending stealer families and curated research from the Hudson Rock team. No fluff, no noise.

  • Weekly issue
  • Zero spam
  • Actionable intel
  • Unsubscribe anytime

Powered by Hudson Rock · By subscribing, you agree to our privacy policy. Unsubscribe anytime.

More threat feeds

Previous weekly summaries

View archive →
Free Tools Check your exposure