Infostealers: The Report
Stealer malware is sold as separate jobs: a licence, installs, a log cloud, logs by the item and tools to sort them. From January to April, almost all raw "stealer" posts came from one brand's notification template. We read what is sold, and in what unit.
- 97.5%
- Of 303,314 raw "stealer" posts, January to Aprilcarried one brand's notification template: a count of a bot's posts, not of infections.
- 82%
- 150 of 182 offer-like posts that named a pricecharged for an access period or licence term rather than per log, per install or per request.
- 6.2%
- Of read posts naming the four largest families offered the product itselfAmong distinct, cleaned posts (95% interval 3.4-11.1%). A family name usually labels a log for sale or retells news.
Brandefense Cybercrime Report 2026 / Infostealers / v1.0 Infostealers: The Log Supply Chain, and Why Raw Counts Mislead Period: 1 January–27 October 2026 · Source: Brandefense Blackhole Get The Infostealer Report.
Read the report, open the evidence records and reuse the charts with their source and limits.
Edition 1.0 · 1 January–27 October 2026 · Free access · 30 October 2026 · Brandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.
Three Investigations. Licences, Installs And Reposted Logs.
Posts are not offers: 393 offer-like posts hold 374 distinct texts, 41 template families cover 28% of the posts, and an October cloud advert closely tracked an August one's wording at a different price.
Units: collected posts and advertised asking terms as written; a bare $ has no stated denomination. They are not infections, sellers or sales.
The full-year PDF edition follows in early 2027. The accessible edition carries the same text, figures and limits as one HTML page for screen readers, zoom and copying text.
- 01 What Stealer Sellers Actually Package Stealer sellers split ads into licences, installs, log clouds and tools, yet most priced posts charge by access period. Read online →
- 02 What 92,000 "Stealer" Posts in January Really Were The stealer keyword count was 97.5% one notification template from January to April 2026. Read online →
- 03 What a Family Name Does in a Post A stealer family name rarely marks a product: only 6.2% of 160 sampled posts naming Lumma, RedLine, Vidar or StealC offered it. Read online →
- 04 Method, limits and the evidence catalogue. A post is not an incident, and an ad does not prove a sale or show that a tool works.
Inspect The Evidence Behind The Report.
Reuse our charts with their source, dates and limits.
Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone.
Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed. Brandefense analysts reviewed and approved the findings.
AI disclosureBrandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.
- 01Counts are Blackhole-collected posts (post IDs or distinct texts), not offers, sellers, sales, victims, infections or people.
- 02The collection is Telegram-dominated; forums are under 1% of the corpus and Tor leak sites are not covered. It does not represent the wider underground.
- 03A raw keyword count follows notification bots; a notification is a claim by a seller or bot, not a verified infection.
- 04Prices are advertised asking terms, kept in the currency as written. Nothing was bought or tested; no price is converted, averaged or presented as a market price.
- 05Keyword and class series are not read as trends: classifier labels are not comparable across the May–July 2026 taxonomy break. No growth, decline or market-share claim is made.
From Research To Monitoring.
See when your company's passwords, data or name show up on criminal forums and markets.
See how it worksCheck Your Domain.
Free exposure check. Enter your company domain and see what is visible from the outside, in about 30 seconds.
The Other Seven Chapters.
The Cybercrime Report 2026 reads eight kinds of activity in the same collection. Each chapter counts its own unit, so compare their limits before you compare their numbers.