Infostealer Threat Report — June 2026
06/01/2026 – 06/30/2026
Threat summary
Key figures from the month's threat activity.
- Ransomware victims711organizations listed on leak sites9.7% decreasefrom the previous monthView details
- Most active ransomware groupQilin78 organizations listedView details
- Exploited vulnerabilities23added to the CISA Known Exploited Vulnerabilities catalogView details
- Publicly disclosed breaches78.2Maccounts affected in 15 breachesView details
Country distribution
417,255
infected devices · in 214 countries
Report periodJun 1, 2026 - Jun 30, 2026
Top five share: 52%
Risk score
66+21vs previous month
- Infected devices
- 417,255
- Android devices
- 208,055
- Countries
- 214
- Domains
- 2,277,181
- Employee accounts
- 84,681
- Customer accounts
- 16,278,486
Top 10 malware families
infectionsTop 10 antivirus
infected devices- 1Windows Defender37,166
- 2Reason Cybersecurity1,539
- 3Kaspersky313
- 4ESET Security129
- 5Quick Heal Total Security127
- 6Norton 360 for Gamers83
- 7Malwarebytes78
- 8Quick Heal AntiVirus Pro75
- 9Norton Security Ultra44
- 10ALYac37
Top 10 domains
- 1633,342
- 2421,989
- 3294,894
- 4281,144
- 5177,263
- 6158,803
- 7114,901
- 899,020
- 998,981
- 1098,271
Breakdown of leaks
Breakdown by sector, file type and critical system.
Employee accounts by sector
organizationsrecordsRansomware victimsemployee accounts- 1Education3.1Korganizations861.4Krecords25Ransomware victims13,679employee accounts
- 2Technology1.4Korganizations4.0Mrecords75Ransomware victims6,762employee accounts
- 3Government886organizations1.3Mrecords27Ransomware victims4,714employee accounts
- 4Telecommunications243organizations150.5Krecords–Ransomware victims2,521employee accounts
- 5Retail and e-commerce387organizations1.1Mrecords63Ransomware victims1,582employee accounts
- 6Travel and hospitality118organizations177.3Krecords–Ransomware victims1,471employee accounts
- 7Manufacturing and industry341organizations103.7Krecords113Ransomware victims1,064employee accounts
- 8Media140organizations710.3Krecords–Ransomware victims915employee accounts
- 9Nonprofit153organizations129.2Krecords–Ransomware victims902employee accounts
- 10Finance223organizations679.9Krecords29Ransomware victims733employee accounts
Report contents
Sections and pages of the full report.
Contents
Download the reportPreparing contents
Other reports
From the Essential plan
Infostealer Detection
See your firm's attack surface on one screen: how many findings, at which severity, on which domain.