Weekly Infostealer Report: 100k Domains Hit

Infostealer Malware Compromised Over 100,000 Domains in One Week

HIGH
July 27, 2026
4m read
MalwareData BreachThreat Intelligence

Related Entities

Organizations

Kaspersky MalwarebytesAvast

Products & Tech

Windows Defender WindowsAndroid

Other

AcreedLumma

MITRE ATT&CK Techniques

T1204.002Execution

User Execution: Malicious File

T1555.003Credential Access

Credentials from Web Browsers

T1041Exfiltration

Exfiltration Over C2 Channel

T1078Initial Access

Valid Accounts

Full Report

Executive Summary

A weekly report on infostealer activity from July 20-27, 2026, highlights the immense scale of credential theft operations, with 101,326 domains compromised in a single week. The campaigns led to the infection of 10,025 machines and 5,026 Android devices. The Acreed infostealer was the most prevalent malware family, accounting for 21,319 compromised machines. Another key finding was that Windows Defender was the most frequently encountered antivirus product on infected systems, suggesting that its default configurations are not sufficient to stop these threats. The Lumma stealer also played a significant role in the weekly compromises.

Threat Overview

The report underscores the continuous and high-volume nature of infostealer malware campaigns. These threats are designed to steal sensitive information from infected devices, including browser cookies, saved passwords, cryptocurrency wallet data, and system information. This stolen data is then aggregated and sold on underground markets or used to facilitate more significant attacks like ransomware or corporate espionage.

Key Statistics (July 20-27, 2026):

  • Compromised Domains: 101,326
  • Infected Machines: 10,025
  • Infected Android Devices: 5,026
  • Top Malware Families:
    1. Acreed: 21,319 machines
    2. Generic Stealer: 18,079 machines
    3. Lumma: 1,284 machines

Technical Analysis

Infostealers are typically distributed through phishing, malicious ads (malvertising), or cracked software. Once executed, they target specific data stores on the victim's machine.

TTPs and MITRE ATT&CK Mapping

  • Execution: Often initiated by the user through social engineering, mapping to T1204.002 - User Execution: Malicious File.
  • Credential Access: The core function of these stealers. They target credentials from various sources, including:
  • Collection: They collect data from browsers, cryptocurrency wallets, and other applications (T1560 - Archive Collected Data).
  • Exfiltration: The stolen data is typically compressed and sent to a command-and-control (C2) server (T1041 - Exfiltration Over C2 Channel).

The finding that Windows Defender was the most common AV on infected systems (10,227 instances) is significant. It suggests that the stealers are either effectively obfuscated to avoid signature-based detection or are using techniques to bypass behavioral protections. The fact that 925 machines had no AV at all highlights ongoing gaps in basic security hygiene.

Impact Assessment

The primary impact of infostealer malware is the theft of credentials and session cookies. For individuals, this can lead to financial loss and identity theft. For organizations, the impact is more severe. When an employee's machine is compromised, their corporate credentials and VPN access tokens can be stolen. This provides threat actors with a foothold inside the corporate network (T1078 - Valid Accounts), which is often the first step in a major ransomware attack or data breach. The sale of these 'initial access' logs on dark web markets is a thriving industry that fuels the broader cybercrime ecosystem.

IOCs — Directly from Articles

No specific Indicators of Compromise (IOCs) were provided in the source articles.

Cyber Observables — Hunting Hints

To hunt for infostealer activity, security teams should look for the following:

Type
file_path
Value
%APPDATA%\..\Local\Google\Chrome\User Data\Default\Login Data
Description
Access to browser credential databases by unusual processes.
Type
process_name
Value
wscript.exe, cscript.exe
Description
Execution of suspicious scripts, often used as droppers for stealers.
Type
network_traffic_pattern
Value
POST requests to unknown domains containing large, encoded data blobs.
Description
A common pattern for data exfiltration.

Detection & Response

  1. Endpoint Detection and Response (EDR): Deploy an EDR solution and configure it to detect and block suspicious process chains, such as a Microsoft Office application spawning a PowerShell script that downloads a file from the internet.
  2. Credential Access Monitoring: Monitor for processes accessing browser credential stores (e.g., Login Data, Local State files) or the Windows credential manager. This is a high-fidelity indicator of credential theft.
  3. Network Monitoring: Analyze egress traffic for connections to known malicious domains or patterns indicative of C2 communication. D3FEND Network Traffic Analysis can help identify these patterns.

Mitigation

  1. Multi-Factor Authentication (MFA): Enforce phishing-resistant MFA wherever possible. While stealers can capture session cookies to bypass basic MFA, it remains a critical defense against the direct use of stolen passwords. This is a core part of M1032 - Multi-factor Authentication.
  2. User Training: Educate users to be skeptical of unsolicited attachments, links, and software downloads, as these are the primary delivery vectors for infostealers. This applies M1017 - User Training.
  3. Endpoint Hardening: Configure Attack Surface Reduction (ASR) rules on Windows to block common malware behaviors, such as script obfuscation and executable content from email clients. This is a key aspect of M1028 - Operating System Configuration.

Timeline of Events

1
July 27, 2026
This article was published

MITRE ATT&CK Mitigations

Multi-factor Authentication

M1032enterprise

Enforcing MFA can prevent stolen passwords from being used directly, though it may not stop session cookie theft.

User Training

M1017enterprise

Training users to identify and avoid phishing and malicious downloads is a key preventative control.

Restrict Web-Based Content

M1021enterprise

Use web filters to block access to known malicious domains and categories commonly used to host malware, such as newly registered domains.

Sources & References

Infostealers Weekly Report: 2026-07-20 – 2026-07-27
Infostealers.com (infostealers.com) •July 26, 2026

Article Author

Jason Gomes

Jason Gomes

• Cybersecurity Practitioner

Cybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.

Threat Intelligence & AnalysisSecurity Orchestration (SOAR/XSOAR)Incident Response & Digital ForensicsSecurity Operations Center (SOC)SIEM & Security AnalyticsCyber Fusion & Threat SharingSecurity Automation & IntegrationManaged Detection & Response (MDR)
LinkedIn

Editorial Standards & Analyst Review

CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.

Tags

InfostealerAcreedLummaMalwareCredential TheftWindows Defender

📢 Share This Article

Help others stay informed about cybersecurity threats

🎯 MITRE ATT&CK Mapped

Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.

🧠 Enriched & Analyzed

Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.

🛡️ Actionable Guidance

Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.

🔗 STIX Visualizer

Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.

⚡ Sigma Generator

Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.