United States of America
United States of America Infostealer Threat Report — September 2026
09/01/2026 – 09/30/2026
Threat summary
Key figures from the month's threat activity.
Overview
Most common malware family: VIDAR (38.6% of infections). Sector with the most employee account leaks: Education. Leaked accounts fell by 13% compared with the previous month.
Ransomware victims in United States of America18,669
infected devices · from 10 families
Report periodSep 1, 2026 - Sep 30, 2026
Risk score
44-6vs previous month
- Infected devices
- 18,669
- Android devices
- 6,071
- Domains
- 151,090
- Employee accounts
- 5,754
- Customer accounts
- 1,511,987
- Families
- 10
Top 10 malware families
infections- 1VIDAR7,197
- 2ACREED2,172
- 3REMUS1,731
- 4LUMMAC893
- 5PUREV4665
- 6STEALC386
- 7REDLINE240
- 8MACSYNC STEALER131
- 9SHAPESHIFTER86
- 10ELYSIUM STEALER44
The full list is in the PDF reportDownload report
Top 10 antivirus
infected devices- 1Windows Defender2,705
- 2Reason Cybersecurity56
- 3Malwarebytes44
- 4Avast41
Breakdown of leaks
Breakdown by sector, file type and critical system.
Employee accounts by sector
organizationsrecordsRansomware victimsemployee accounts- 1Education457organizations76.7Krecords14Ransomware victims1,474employee accounts
- 2Technology122organizations406.8Krecords23Ransomware victims366employee accounts
- 3Government42organizations54.4Krecords8Ransomware victims143employee accounts
- 4Telecommunications15organizations19.7Krecords–Ransomware victims133employee accounts
- 5Retail and e-commerce29organizations119.6Krecords19Ransomware victims94employee accounts
- 6Healthcare32organizations19.2Krecords43Ransomware victims75employee accounts
- 7Logistics and transport8organizations11.7Krecords7Ransomware victims68employee accounts
- 8Energy4organizations901records7Ransomware victims61employee accounts
- 9Travel and hospitality9organizations21.8Krecords–Ransomware victims57employee accounts
- 10Gaming and betting16organizations68.1Krecords–Ransomware victims55employee accounts
The full list is in the PDF reportDownload report
Report contents
Sections and pages of the full report.
Contents
Download the reportPreparing contents
Other reports
From the Essential plan
Infostealer Detection
See your firm's attack surface on one screen: how many findings, at which severity, on which domain.