Infostealer Threat Report — May 2026
05/01/2026 – 05/31/2026
Threat summary
Key figures from the month's threat activity.
- Ransomware victims787organizations listed on leak sites9% decreasefrom the previous monthView details
- Most active ransomware groupQilin113 organizations listedView details
- Exploited vulnerabilities21added to the CISA Known Exploited Vulnerabilities catalogView details
- Publicly disclosed breaches50.3Maccounts affected in 21 breachesView details
Country distribution
254,885
infected devices · in 224 countries
Report periodMay 1, 2026 - May 31, 2026
Top five share: 47%
Risk score
45+10vs previous month
- Infected devices
- 254,885
- Android devices
- 123,730
- Countries
- 224
- Domains
- 1,938,604
- Employee accounts
- 60,642
- Customer accounts
- 12,359,291
Top 10 malware families
infectionsTop 10 antivirus
infected devices- 1Windows Defender34,732
- 2Reason Cybersecurity1,586
- 3Malwarebytes154
- 4Norton 360 for Gamers142
- 5Kaspersky97
- 6ALYac33
- 7ESET Security28
- 8360 Total Security27
- 9Avast Antivirus27
- 10Norton Security Ultra24
Top 10 domains
- 1480,840
- 2320,921
- 3232,897
- 4212,377
- 5135,326
- 6124,564
- 791,546
- 877,580
- 977,312
- 1075,070
Breakdown of leaks
Breakdown by sector, file type and critical system.
Employee accounts by sector
organizationsrecordsRansomware victimsemployee accounts- 1Education2.6Korganizations648.9Krecords29Ransomware victims11,319employee accounts
- 2Technology1.2Korganizations3.1Mrecords86Ransomware victims5,637employee accounts
- 3Government737organizations889.2Krecords25Ransomware victims3,214employee accounts
- 4Telecommunications204organizations114.9Krecords–Ransomware victims1,757employee accounts
- 5Retail and e-commerce285organizations818.8Krecords62Ransomware victims781employee accounts
- 6Nonprofit138organizations105.4Krecords–Ransomware victims705employee accounts
- 7Manufacturing and industry240organizations75.3Krecords130Ransomware victims587employee accounts
- 8Finance189organizations564.4Krecords36Ransomware victims538employee accounts
- 9Healthcare153organizations62.6Krecords68Ransomware victims383employee accounts
- 10Travel and hospitality82organizations138.1Krecords–Ransomware victims372employee accounts
Report contents
Sections and pages of the full report.
Contents
Download the reportPreparing contents
Other reports
From the Essential plan
Infostealer Detection
See your firm's attack surface on one screen: how many findings, at which severity, on which domain.