United States of America
United States of America Infostealer Threat Report — May 2026
05/01/2026 – 05/31/2026
Threat summary
Key figures from the month's threat activity.
Overview
Most common malware family: PUREV4 (45.1% of infections). Sector with the most employee account leaks: Education. Leaked accounts rose by 26.2% compared with the previous month.
Ransomware victims in United States of America16,407
infected devices · from 10 families
Report periodMay 1, 2026 - May 31, 2026
Risk score
63+15vs previous month
- Infected devices
- 16,407
- Android devices
- 5,945
- Domains
- 142,252
- Employee accounts
- 5,620
- Customer accounts
- 1,474,824
- Families
- 10
Top 10 malware families
infections- 1PUREV47,398
- 2VIDAR2,744
- 3REMUS1,984
- 4REDLINE1,605
- 5LUMMAC782
- 6SHUB STEALER431
- 7ARKEI280
- 8STEALC133
- 9SHAPESHIFTER125
- 10ELYSIUM STEALER65
The full list is in the PDF reportDownload report
Top 10 antivirus
infected devices- 1Windows Defender2,149
- 2Reason Cybersecurity169
- 3Malwarebytes36
- 4Norton 360 for Gamers17
Breakdown of leaks
Breakdown by sector, file type and critical system.
Employee accounts by sector
organizationsrecordsRansomware victimsemployee accounts- 1Education547organizations89.7Krecords10Ransomware victims2,121employee accounts
- 2Technology113organizations394.8Krecords27Ransomware victims348employee accounts
- 3Telecommunications16organizations16.9Krecords–Ransomware victims119employee accounts
- 4Government47organizations46.1Krecords10Ransomware victims116employee accounts
- 5Logistics and transport5organizations10.3Krecords10Ransomware victims101employee accounts
- 6Retail and e-commerce30organizations120.2Krecords22Ransomware victims83employee accounts
- 7Healthcare26organizations17.4Krecords45Ransomware victims60employee accounts
- 8Manufacturing and industry20organizations9.0Krecords46Ransomware victims56employee accounts
- 9Gaming and betting12organizations75.9Krecords–Ransomware victims36employee accounts
- 10Nonprofit15organizations13.1Krecords–Ransomware victims35employee accounts
The full list is in the PDF reportDownload report
Report contents
Sections and pages of the full report.
Contents
Download the reportPreparing contents
Other reports
From the Essential plan
Infostealer Detection
See your firm's attack surface on one screen: how many findings, at which severity, on which domain.