Infostealer Threat Report — February 2026
02/01/2026 – 02/28/2026
Threat summary
Key figures from the month's threat activity.
- Ransomware victims785organizations listed on leak sites12.1% increasefrom the previous monthView details
- Most active ransomware groupQilin115 organizations listedView details
- Exploited vulnerabilities28added to the CISA Known Exploited Vulnerabilities catalogView details
- Publicly disclosed breaches62Maccounts affected in 12 breachesView details
Country distribution
588,151
infected devices · in 230 countries
Report periodFeb 1, 2026 - Feb 28, 2026
Top five share: 37%
Risk score
56+6vs previous month
- Infected devices
- 588,151
- Android devices
- 267,517
- Countries
- 230
- Domains
- 2,335,795
- Employee accounts
- 85,038
- Customer accounts
- 15,487,810
Top 10 malware families
infectionsTop 10 antivirus
infected devices- 1Windows Defender344,328
- 2Reason Cybersecurity803
- 3Quick Heal Total Security137
- 4Bitdefender91
- 5Norton Security67
- 6Kaspersky65
- 7Avira55
- 8ALYac37
- 9Avast Free Antivirus30
- 10ESET Security23
Top 10 domains
- 1605,646
- 2436,342
- 3362,277
- 4305,303
- 5183,267
- 6171,232
- 7112,452
- 8106,752
- 9102,238
- 1094,803
Breakdown of leaks
Breakdown by sector, file type and critical system.
Employee accounts by sector
organizationsrecordsRansomware victimsemployee accounts- 1Education3.2Korganizations809.0Krecords–Ransomware victims12,784employee accounts
- 2Technology1.6Korganizations3.9Mrecords126Ransomware victims7,510employee accounts
- 3Government900organizations1.1Mrecords28Ransomware victims3,934employee accounts
- 4Telecommunications295organizations154.3Krecords–Ransomware victims2,395employee accounts
- 5Retail and e-commerce374organizations1.0Mrecords55Ransomware victims1,541employee accounts
- 6Manufacturing and industry287organizations99.5Krecords148Ransomware victims1,254employee accounts
- 7Nonprofit152organizations126.1Krecords–Ransomware victims862employee accounts
- 8Finance253organizations660.6Krecords54Ransomware victims654employee accounts
- 9Travel and hospitality126organizations170.8Krecords26Ransomware victims547employee accounts
- 10Healthcare187organizations73.9Krecords69Ransomware victims547employee accounts
Report contents
Sections and pages of the full report.
Contents
Download the reportPreparing contents
Other reports
From the Essential plan
Infostealer Detection
See your firm's attack surface on one screen: how many findings, at which severity, on which domain.