India
India Infostealer Threat Report — March 2026
03/01/2026 – 03/31/2026
Threat summary
Key figures from the month's threat activity.
Overview
Most common malware family: VIDAR (46.7% of infections). Sector with the most employee account leaks: Education. Leaked accounts rose by 22.1% compared with the previous month.
Ransomware victims in India81,711
infected devices · from 10 families
Report periodMar 1, 2026 - Mar 31, 2026
Risk score
61+4vs previous month
- Infected devices
- 81,711
- Android devices
- 47,430
- Domains
- 143,607
- Employee accounts
- 8,016
- Customer accounts
- 1,777,655
- Families
- 10
Top 10 malware families
infections- 1VIDAR38,139
- 2PUREV427,216
- 3ARKEI5,224
- 4STEALC3,331
- 5REDLINE2,098
- 6LUMMAC1,464
- 7REMUS786
- 8MACSYNC STEALER425
- 9SHUB STEALER264
- 10SHAPESHIFTER261
The full list is in the PDF reportDownload report
Top 10 antivirus
infected devices- 1Windows Defender35,416
- 2Reason Cybersecurity23
- 3Quick Heal Total Security10
Breakdown of leaks
Breakdown by sector, file type and critical system.
Employee accounts by sector
organizationsrecordsRansomware victimsemployee accounts- 1Education284organizations115.9Krecords–Ransomware victims1,406employee accounts
- 2Technology209organizations475.2Krecords3Ransomware victims1,063employee accounts
- 3Nonprofit11organizations14.8Krecords–Ransomware victims510employee accounts
- 4Healthcare28organizations7.2Krecords3Ransomware victims306employee accounts
- 5Finance59organizations82.3Krecords1Ransomware victims287employee accounts
- 6Government43organizations304.8Krecords–Ransomware victims238employee accounts
- 7Retail and e-commerce41organizations73.3Krecords–Ransomware victims176employee accounts
- 8Manufacturing and industry46organizations9.5Krecords5Ransomware victims77employee accounts
- 9Travel and hospitality18organizations9.4Krecords–Ransomware victims69employee accounts
- 10Telecommunications13organizations9.3Krecords–Ransomware victims68employee accounts
The full list is in the PDF reportDownload report
Report contents
Sections and pages of the full report.
Contents
Download the reportPreparing contents
Other reports
From the Essential plan
Infostealer Detection
See your firm's attack surface on one screen: how many findings, at which severity, on which domain.