Stealer malware is sold as separate jobs: a licence, installs, a log cloud, logs by the item and tools to sort them. From January to April, almost all raw "stealer" posts came from one brand's notification template. We read what is sold, and in what unit.
Each finding below is stated in its own unit, with the limit that comes with it. The investigations give the full reasoning and the evidence records.
Findings 01 and 03. Each bar is a share of its own base, so do not compare the two bars.
| Share | Measure | Posts | Base |
|---|---|---|---|
| 82% | Priced a time period or licence term | 150 | 182 offer-like posts with an amount |
| 6.2% | Offered the named family's product | 10 | 160 read posts naming Lumma, RedLine, Vidar or StealC |
Each investigation answers a different question from the same collected posts. Start with the main one, then follow the question that matters to your team.
Stealer sellers split the offer into licences, installs, log clouds, single logs and processing tools. Period pricing dominates the two largest roles, log clouds and licences, though not every role.
Read the investigation →One notification template made up 97.5% of the raw "stealer" posts collected from January to April 2026. The count tracks a bot's posting rate, not infections or market size.
Read the investigation →Of 160 posts naming Lumma, RedLine, Vidar or StealC, only 6.2% offered the product. More than half used the name to tag logs or retell news.
Read the investigation →Compare hosted services, worker accounts, access transfer and account-data requests in our cross-chapter analysis.
Explore the work and control analysis ↗These are implications of what the posts say, not measured control results. Each one points to a different decision.
Count exposures by credential or session, not by post, channel or family keyword: resale and copied templates mean the same log surfaces more than once.
Treat a stealer family name in an alert as a label on data, not as attribution. Reset credentials and revoke sessions without waiting to confirm the family; a host scan for that family can come back clean while the exposure is real.
A log-feed advertisement does not establish when your own sessions were exposed. If exposed session material matches your organisation, revoke the affected sessions and investigate the endpoint.
A cloud's access price cannot tell you how much of your data is exposed; a period price does not state quantity. Do not infer exposure volume from an advertised subscription.
Do not threshold on a raw keyword such as "stealer": the series follows notification bots. Report the top template's share next to any total, and keep bots in a separate series from adverts and discussion.
See when your company's passwords, data or name show up on criminal forums and markets.
See how it works →Free exposure check. Enter your company domain and see what is visible from the outside, in about 30 seconds.
The word "stealer" appeared in 303,314 Blackhole posts dated 1 January to 30 April 2026 (exact totals over query windows of seven days or less). 295,819 of them (97.5%) carried one brand's constant notification-template label, posted about 2,700 times a day until it stopped on 25 April.
A raw keyword count here measures a bot's posting schedule, not infections, offers or market size.
Read the report, open the evidence records and reuse the charts with their source and limits.
Original aggregate tables, charts and editorial paraphrases: CC BY 4.0. Keep the source, version, date range and measurement limits with reused figures.
30 October 2026 · Brandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.
The Cybercrime Report 2026 reads eight kinds of activity in the same collection. Each chapter counts its own unit, so compare their limits before you compare their numbers.
