Infostealer Threat Report — October 2026
10/01/2026 – 10/31/2026
Threat summary
Key figures from the month's threat activity.
- Ransomware victims1,234organizations listed on leak sites45.2% increasefrom the previous monthView details
- Most active ransomware groupQilin197 organizations listedView details
- Exploited vulnerabilities36added to the CISA Known Exploited Vulnerabilities catalogView details
- Publicly disclosed breaches9.3Maccounts affected in 9 breachesView details
Country distribution
236,043
infected devices · in 195 countries
Report periodOct 1, 2026 - Oct 31, 2026
Top five share: 30%
Risk score
33-25vs previous month
- Infected devices
- 236,043
- Android devices
- 94,506
- Countries
- 195
- Domains
- 1,846,379
- Employee accounts
- 58,881
- Customer accounts
- 10,736,726
Top 10 malware families
infectionsTop 10 antivirus
infected devices- 1Windows Defender17,783
- 2Reason Cybersecurity688
- 3Malwarebytes109
- 4Kaspersky103
- 5Avast52
- 6ESET Security36
- 7Tencent PC Manager28
- 8Norton 360 for Gamers21
- 9Norton Security Ultra17
- 10Norton Security16
Top 10 domains
- 1402,774
- 2253,122
- 3183,970
- 4172,986
- 5103,466
- 699,066
- 775,056
- 862,958
- 961,420
- 1059,753
Breakdown of leaks
Breakdown by sector, file type and critical system.
Employee accounts by sector
organizationsrecordsRansomware victimsemployee accounts- 1Education2.1Korganizations574.1Krecords63Ransomware victims7,130employee accounts
- 2Government808organizations790.6Krecords34Ransomware victims4,474employee accounts
- 3Technology936organizations2.6Mrecords126Ransomware victims4,464employee accounts
- 4Telecommunications224organizations111.5Krecords–Ransomware victims1,563employee accounts
- 5Retail and e-commerce252organizations741.6Krecords69Ransomware victims770employee accounts
- 6Finance142organizations444.2Krecords48Ransomware victims488employee accounts
- 7Manufacturing and industry193organizations76.0Krecords173Ransomware victims462employee accounts
- 8Nonprofit128organizations98.6Krecords–Ransomware victims411employee accounts
- 9Media106organizations474.8Krecords–Ransomware victims338employee accounts
- 10Gaming and betting103organizations507.8Krecords–Ransomware victims270employee accounts
Report contents
Sections and pages of the full report.
Contents
Download the reportPreparing contents
Other reports
From the Essential plan
Infostealer Detection
See your firm's attack surface on one screen: how many findings, at which severity, on which domain.