Infostealer Threat Report — March 2026
03/01/2026 – 03/31/2026
Threat summary
Key figures from the month's threat activity.
- Ransomware victims843organizations listed on leak sites7.4% increasefrom the previous monthView details
- Most active ransomware groupQilin140 organizations listedView details
- Exploited vulnerabilities26added to the CISA Known Exploited Vulnerabilities catalogView details
- Publicly disclosed breaches5.7Maccounts affected in 12 breachesView details
Country distribution
586,333
infected devices · in 238 countries
Report periodMar 1, 2026 - Mar 31, 2026
Top five share: 36%
Risk score
63+7vs previous month
- Infected devices
- 586,333
- Android devices
- 324,153
- Countries
- 238
- Domains
- 2,759,839
- Employee accounts
- 97,962
- Customer accounts
- 19,575,338
Top 10 malware families
infectionsTop 10 antivirus
infected devices- 1Windows Defender184,186
- 2Reason Cybersecurity499
- 3Malwarebytes18
- 4ESET Security17
- 5Kaspersky17
- 6Quick Heal Total Security10
- 7Norton 360 for Gamers9
- 8HP Wolf Pro Security8
- 9Panda Dome7
- 10Norton Security Ultra6
Top 10 domains
- 1767,891
- 2557,877
- 3396,857
- 4381,458
- 5225,243
- 6192,647
- 7139,144
- 8133,552
- 9121,469
- 10115,666
Breakdown of leaks
Breakdown by sector, file type and critical system.
Employee accounts by sector
organizationsrecordsRansomware victimsemployee accounts- 1Education3.6Korganizations1.0Mrecords31Ransomware victims15,429employee accounts
- 2Technology1.7Korganizations4.8Mrecords126Ransomware victims9,038employee accounts
- 3Government1.3Korganizations1.6Mrecords41Ransomware victims5,804employee accounts
- 4Telecommunications363organizations205.7Krecords–Ransomware victims2,509employee accounts
- 5Retail and e-commerce462organizations1.3Mrecords61Ransomware victims1,265employee accounts
- 6Manufacturing and industry369organizations127.6Krecords168Ransomware victims1,225employee accounts
- 7Finance326organizations828.0Krecords53Ransomware victims1,211employee accounts
- 8Nonprofit214organizations166.3Krecords–Ransomware victims1,170employee accounts
- 9Healthcare216organizations94.6Krecords64Ransomware victims1,033employee accounts
- 10Travel and hospitality129organizations215.3Krecords–Ransomware victims751employee accounts
Report contents
Sections and pages of the full report.
Contents
Download the reportPreparing contents
Other reports
From the Essential plan
Infostealer Detection
See your firm's attack surface on one screen: how many findings, at which severity, on which domain.