Infostealers weekly report 12-19 Oct 2026: Gmail, Google and Facebook credentials dominate stealer logs, Indian banks among top corporate victims
The weekly InfoStealers report for 12-19 October 2026 summarises stealer-log telemetry on compromised machines, credentials and sessions. The United States ranks #8 by country of infection with 438 machines. Gmail is the most affected email provider with 1,225,748 users, followed by Hotmail (90,554) and Yahoo (33,493). Sessions and saved credentials for google.com (24,784 users), facebook.com (17,762) and instagram.com (13,495) are the most exposed. Employee exposure is highest at Indian banking and webmail domains such as icicibank.com (285), hostinger.com (275) and rediff.com (232). Among S&P companies, salesforce.com (21 employees) and microsoft.com (18) lead.
Technical Details
- Generic Stealer accounts for 25,169 machines and Warden Stealer for 2,150 machines. Other families are not named in the excerpt.
- Antivirus on infected hosts: Windows Defender on 11,267 machines, 159 machines with no AV detected, and smaller counts for Malwarebytes, Avast, Norton, Reason Cybersecurity and 360 Total Security.
- Government-related corporate domains in the logs include buenosaires.gob.ar (62), indiapost.gov.in (39), secop.gov.co (38) and mail.gov.in (36). Banking domains include netpnb.com, bobibanking.com, unionbankonline.co.in and santander.com.br.
- Exposed sessions also cover microsoftonline.com (6,623 users), github.com (4,151), openai.com (5,134), paypal.com (5,356) and discord.com (8,898). Android app caches (Facebook, Instagram, Netflix, Snapchat and others) also appear.
- The article does not describe distribution vectors, IOCs or attribution.
Remediation
The article gives no remediation guidance. Defenders can use the data as a prioritisation signal for credential and session-token resets, MFA enforcement and monitoring of stealer-log exposure for their own domains.
Linha do tempo
-
Infostealers weekly report 12-19 Oct 2026: Gmail, Google and Facebook credentials dominate stealer logs, Indian banks among top corporate victims
ler a análise desta fonte ocultar
The weekly InfoStealers report for 12-19 October 2026 summarises stealer-log telemetry on compromised machines, credentials and sessions. The United States ranks #8 by country of infection with 438 machines. Gmail is the most affected email provider with 1,225,748 users, followed by Hotmail (90,554) and Yahoo (33,493). Sessions and saved credentials for google.com (24,784 users), facebook.com (17,762) and instagram.com (13,495) are the most exposed. Employee exposure is highest at Indian banking and webmail domains such as icicibank.com (285), hostinger.com (275) and rediff.com (232). Among S&P companies, salesforce.com (21 employees) and microsoft.com (18) lead.
Technical Details
- Generic Stealer accounts for 25,169 machines and Warden Stealer for 2,150 machines. Other families are not named in the excerpt.
- Antivirus on infected hosts: Windows Defender on 11,267 machines, 159 machines with no AV detected, and smaller counts for Malwarebytes, Avast, Norton, Reason Cybersecurity and 360 Total Security.
- Government-related corporate domains in the logs include buenosaires.gob.ar (62), indiapost.gov.in (39), secop.gov.co (38) and mail.gov.in (36). Banking domains include netpnb.com, bobibanking.com, unionbankonline.co.in and santander.com.br.
- Exposed sessions also cover microsoftonline.com (6,623 users), github.com (4,151), openai.com (5,134), paypal.com (5,356) and discord.com (8,898). Android app caches (Facebook, Instagram, Netflix, Snapchat and others) also appear.
- The article does not describe distribution vectors, IOCs or attribution.
Remediation
The article gives no remediation guidance. Defenders can use the data as a prioritisation signal for credential and session-token resets, MFA enforcement and monitoring of stealer-log exposure for their own domains.