Infostealer Threat Report — April 2026
04/01/2026 – 04/30/2026
Threat summary
Key figures from the month's threat activity.
- Ransomware victims865organizations listed on leak sites2.6% increasefrom the previous monthView details
- Most active ransomware groupQilin108 organizations listedView details
- Exploited vulnerabilities31added to the CISA Known Exploited Vulnerabilities catalogView details
- Publicly disclosed breaches41.9Maccounts affected in 11 breachesView details
Country distribution
342,698
infected devices · in 233 countries
Report periodApr 1, 2026 - Apr 30, 2026
Top five share: 42%
Risk score
35-28vs previous month
- Infected devices
- 342,698
- Android devices
- 185,494
- Countries
- 233
- Domains
- 2,041,507
- Employee accounts
- 63,059
- Customer accounts
- 13,598,831
Top 10 malware families
infectionsTop 10 antivirus
infected devices- 1Windows Defender166,845
- 2Reason Cybersecurity1,002
- 3Kaspersky75
- 4Malwarebytes75
- 5Quick Heal Total Security40
- 6Quick Heal AntiVirus Pro37
- 7ESET Security34
- 8Norton 360 for Gamers25
- 9Panda Dome22
- 10360 Total Security19
Top 10 domains
- 1545,174
- 2389,348
- 3321,525
- 4263,283
- 5153,496
- 6148,594
- 797,311
- 885,610
- 984,299
- 1084,204
Breakdown of leaks
Breakdown by sector, file type and critical system.
Employee accounts by sector
organizationsrecordsRansomware victimsemployee accounts- 1Education2.6Korganizations710.4Krecords–Ransomware victims10,338employee accounts
- 2Technology1.2Korganizations3.4Mrecords96Ransomware victims5,154employee accounts
- 3Government798organizations1.0Mrecords32Ransomware victims4,247employee accounts
- 4Telecommunications229organizations120.3Krecords–Ransomware victims1,548employee accounts
- 5Retail and e-commerce285organizations829.1Krecords86Ransomware victims924employee accounts
- 6Nonprofit140organizations106.6Krecords–Ransomware victims798employee accounts
- 7Manufacturing and industry214organizations80.6Krecords150Ransomware victims664employee accounts
- 8Finance196organizations582.6Krecords42Ransomware victims523employee accounts
- 9Media126organizations559.1Krecords–Ransomware victims442employee accounts
- 10Travel and hospitality97organizations140.1Krecords–Ransomware victims321employee accounts
Report contents
Sections and pages of the full report.
Contents
Download the reportPreparing contents
Other reports
From the Essential plan
Infostealer Detection
See your firm's attack surface on one screen: how many findings, at which severity, on which domain.