Infostealer Threat Report — January 2026
01/01/2026 – 01/31/2026
Threat summary
Key figures from the month's threat activity.
- Ransomware victims700organizations listed on leak sites20.5% decreasefrom the previous monthView details
- Most active ransomware groupQilin109 organizations listedView details
- Exploited vulnerabilities17added to the CISA Known Exploited Vulnerabilities catalogView details
- Publicly disclosed breaches131.2Maccounts affected in 8 breachesView details
Country distribution
423,390
infected devices · in 229 countries
Report periodJan 1, 2026 - Jan 31, 2026
Top five share: 42%
Risk score
50
- Infected devices
- 423,390
- Android devices
- 198,612
- Countries
- 229
- Domains
- 2,033,116
- Employee accounts
- 72,039
- Customer accounts
- 13,742,260
Top 10 malware families
infectionsTop 10 antivirus
infected devices- 1Windows Defender134,770
- 2Kaspersky26
- 3Avira17
- 4Reason Cybersecurity15
- 5McAfee12
- 6ESET Security11
- 7Avast Free Antivirus11
- 8Trend Micro6
- 9Norton Security5
- 10Avira Security2
Top 10 domains
- 1542,414
- 2382,452
- 3315,565
- 4279,749
- 5152,711
- 6150,451
- 795,808
- 890,459
- 982,806
- 1081,876
Breakdown of leaks
Breakdown by sector, file type and critical system.
Employee accounts by sector
organizationsrecordsRansomware victimsemployee accounts- 1Education2.5Korganizations684.1Krecords27Ransomware victims10,224employee accounts
- 2Technology1.2Korganizations3.4Mrecords116Ransomware victims6,234employee accounts
- 3Government816organizations995.1Krecords30Ransomware victims3,847employee accounts
- 4Telecommunications259organizations141.4Krecords–Ransomware victims1,862employee accounts
- 5Manufacturing and industry262organizations92.8Krecords139Ransomware victims991employee accounts
- 6Retail and e-commerce323organizations929.3Krecords59Ransomware victims877employee accounts
- 7Nonprofit142organizations116.5Krecords–Ransomware victims806employee accounts
- 8Healthcare141organizations69.5Krecords49Ransomware victims757employee accounts
- 9Finance177organizations601.8Krecords42Ransomware victims679employee accounts
- 10Logistics and transport120organizations94.1Krecords–Ransomware victims667employee accounts
Report contents
Sections and pages of the full report.
Contents
Download the reportPreparing contents
Other reports
From the Essential plan
Infostealer Detection
See your firm's attack surface on one screen: how many findings, at which severity, on which domain.