Infostealer Threat Report — July 2026
07/01/2026 – 07/31/2026
Threat summary
Key figures from the month's threat activity.
- Ransomware victims952organizations listed on leak sites33.9% increasefrom the previous monthView details
- Most active ransomware groupThegentlemen177 organizations listedView details
- Exploited vulnerabilities26added to the CISA Known Exploited Vulnerabilities catalogView details
- Publicly disclosed breaches89.9Maccounts affected in 7 breachesView details
Country distribution
348,686
infected devices · in 217 countries
Report periodJul 1, 2026 - Jul 31, 2026
Top five share: 27%
Risk score
56-10vs previous month
- Infected devices
- 348,686
- Android devices
- 143,402
- Countries
- 217
- Domains
- 2,589,992
- Employee accounts
- 104,076
- Customer accounts
- 18,317,942
Top 10 malware families
infectionsTop 10 antivirus
infected devices- 1Windows Defender57,827
- 2Reason Cybersecurity2,360
- 3Kaspersky368
- 4Malwarebytes224
- 5ESET Security141
- 6Norton Security Ultra88
- 7Norton 360 for Gamers77
- 8Panda Dome50
- 9ALYac42
- 10360 Total Security40
Top 10 domains
- 1686,426
- 2477,475
- 3328,834
- 4294,443
- 5180,450
- 6170,063
- 7119,496
- 8116,911
- 9110,688
- 10109,821
Breakdown of leaks
Breakdown by sector, file type and critical system.
Employee accounts by sector
organizationsrecordsRansomware victimsemployee accounts- 1Education3.3Korganizations903.6Krecords–Ransomware victims15,023employee accounts
- 2Technology1.6Korganizations4.4Mrecords126Ransomware victims11,264employee accounts
- 3Government1.3Korganizations1.3Mrecords37Ransomware victims6,111employee accounts
- 4Telecommunications307organizations200.1Krecords–Ransomware victims3,317employee accounts
- 5Retail and e-commerce393organizations1.3Mrecords70Ransomware victims1,331employee accounts
- 6Manufacturing and industry368organizations126.5Krecords152Ransomware victims1,169employee accounts
- 7Media170organizations844.6Krecords–Ransomware victims1,036employee accounts
- 8Finance237organizations788.3Krecords50Ransomware victims701employee accounts
- 9Healthcare174organizations95.5Krecords84Ransomware victims687employee accounts
- 10Nonprofit200organizations157.6Krecords–Ransomware victims642employee accounts
Report contents
Sections and pages of the full report.
Contents
Download the reportPreparing contents
Other reports
From the Essential plan
Infostealer Detection
See your firm's attack surface on one screen: how many findings, at which severity, on which domain.