Weekly Infostealer Report: 100k Domains Hit

Originally published on CyberNetSec.

Executive Summary

A weekly report on infostealer activity from July 20-27, 2026, highlights the immense scale of credential theft operations, with 101,326 domains compromised in a single week. The campaigns led to the infection of 10,025 machines and 5,026 Android devices. The Acreed infostealer was the most prevalent malware family, accounting for 21,319 compromised machines. Another key finding was that Windows Defender was the most frequently encountered antivirus product on infected systems, suggesting that its default configurations are not sufficient to stop these threats. The Lumma stealer also played a significant role in the weekly compromises.

---

Threat Overview

The report underscores the continuous and high-volume nature of infostealer malware campaigns. These threats are designed to steal sensitive information from infected devices, including browser cookies, saved passwords, cryptocurrency wallet data, and system information. This stolen data is then aggregated and sold on underground markets or used to facilitate more significant attacks like ransomware or corporate espionage.

Key Statistics (July 20-27, 2026):

• Compromised Domains: 101,326
• Infected Machines: 10,025
• Infected Android Devices: 5,026
• Top Malware Families:
  1. Acreed: 21,319 machines
  2. Generic Stealer: 18,079 machines
  3. Lumma: 1,284 machines

Technical Analysis

Infostealers are typically distributed through phishing, malicious ads (malvertising), or cracked software. Once executed, they target specific data stores on the victim's machine.

TTPs and MITRE ATT&CK Mapping

• Execution: Often initiated by the user through social engineering, mapping to T1204.002 - User Execution: Malicious File.
• Credential Access: The core function of these stealers. They target credentials from various sources, including:
  • T1555.003 - Credentials from Web Browsers
  • T1552.001 - Credentials In Files
• Collection: They collect data from browsers, cryptocurrency wallets, and other applications (T1560 - Archive Collected Data).
• Exfiltration: The stolen data is typically compressed and sent to a command-and-control (C2) server (T1041 - Exfiltration Over C2 Channel).

The finding that Windows Defender was the most common AV on infected systems (10,227 instances) is significant. It suggests that the stealers are either effectively obfuscated to avoid signature-based detection or are using techniques to bypass behavioral protections. The fact that 925 machines had no AV at all highlights ongoing gaps in basic security hygiene.

Impact Assessment

The primary impact of infostealer malware is the theft of credentials and session cookies. For individuals, this can lead to financial loss and identity theft. For organizations, the impact is more severe. When an employee's machine is compromised, their corporate credentials and VPN access tokens can be stolen. This provides threat actors with a foothold inside the corporate network (T1078 - Valid Accounts), which is often the first step in a major ransomware attack or data breach. The sale of these 'initial access' logs on dark web markets is a thriving industry that fuels the broader cybercrime ecosystem.

IOCs — Directly from Articles

No specific Indicators of Compromise (IOCs) were provided in the source articles.

Cyber Observables — Hunting Hints

To hunt for infostealer activity, security teams should look for the following:
| Type | Value | Description |
|---|---|---|
| file_path | %APPDATA%\..\Local\Google\Chrome\User Data\Default\Login Data | Access to browser credential databases by unusual processes. |
| process_name | wscript.exe, cscript.exe | Execution of suspicious scripts, often used as droppers for stealers. |
| network_traffic_pattern | POST requests to unknown domains containing large, encoded data blobs. | A common pattern for data exfiltration. |

Detection & Response

1. Endpoint Detection and Response (EDR): Deploy an EDR solution and configure it to detect and block suspicious process chains, such as a Microsoft Office application spawning a PowerShell script that downloads a file from the internet.
2. Credential Access Monitoring: Monitor for processes accessing browser credential stores (e.g., Login Data, Local State files) or the Windows credential manager. This is a high-fidelity indicator of credential theft.
3. Network Monitoring: Analyze egress traffic for connections to known malicious domains or patterns indicative of C2 communication. D3FEND Network Traffic Analysis can help identify these patterns.

Mitigation

1. Multi-Factor Authentication (MFA): Enforce phishing-resistant MFA wherever possible. While stealers can capture session cookies to bypass basic MFA, it remains a critical defense against the direct use of stolen passwords. This is a core part of M1032 - Multi-factor Authentication.
2. User Training: Educate users to be skeptical of unsolicited attachments, links, and software downloads, as these are the primary delivery vectors for infostealers. This applies M1017 - User Training.
3. Endpoint Hardening: Configure Attack Surface Reduction (ASR) rules on Windows to block common malware behaviors, such as script obfuscation and executable content from email clients. This is a key aspect of M1028 - Operating System Configuration.