{ "version": "1.0", "built_date": "2026-10-30", "title": "Infostealers: the log supply chain and why raw counts mislead", "creator": "Brandefense Research Team", "source": "Brandefense Blackhole", "period": { "start": "2026-01-01", "end": "2026-10-27", "label": "1 January–27 October 2026", "timezone": "as_recorded", "query_window_timezone": "UTC", "partial_month": "2026-10", "date_field": "post.created_at", "date_semantics": "Recorded source post dates; query windows used UTC bounds of seven days or less." }, "summary": { "k_stealer_raw_total_jan_apr": 303314, "feed_label_posts_jan_apr": 295819, "feed_label_share_jan_apr_pct": 97.5, "k_stealer_raw_total_jan": 92367, "feed_label_posts_jan": 90621, "candidate_posts_classified": 694, "priority_flagged": 250, "offer_like_posts": 393, "priced_offer_like_posts": 182, "priced_by_unit": { "time_or_licence_period": 150, "per_item_volume_or_quota": 15, "flat_or_bundle": 13, "other": 3, "percent_or_share": 1 }, "catalogue_records": 40, "feed_records": 10, "family_role_sampled_posts": 392, "family_role_four_names_sampled": 160, "family_role_four_names_product_offered": 10, "validity_wording": { "n": 20, "of": 236, "share_pct": 8.5, "pattern": "\\bvalid\\b|\\bhit\\s+rate\\b|\\bchecked\\b", "flags": [ "IGNORECASE" ], "exclusions": [], "scope": "coded log_feed_or_cloud_ad candidate posts; one match per post; wording not tested validity" }, "validation_sample_n": 40, "validation_intent_agree": 31, "validation_offer_vs_non_offer_agree": 37, "human_signoff": false }, "sets": [ { "set_id": "k_infostealer", "kind": "keyword", "search_phrase": "infostealer", "raw_total_exact_sum": 978, "fetched_rows": 952, "months": 10 }, { "set_id": "k_lumma", "kind": "keyword", "search_phrase": "lumma", "raw_total_exact_sum": 699, "fetched_rows": 696, "months": 10 }, { "set_id": "k_redline", "kind": "keyword", "search_phrase": "redline", "raw_total_exact_sum": 1030, "fetched_rows": 975, "months": 10 }, { "set_id": "k_stealer", "kind": "keyword", "search_phrase": "stealer", "raw_total_exact_sum": 317473, "fetched_rows": 5308, "months": 10 }, { "set_id": "s_acreed", "kind": "keyword", "search_phrase": "acreed", "raw_total_exact_sum": 16, "fetched_rows": 15, "months": 10 }, { "set_id": "s_amatera", "kind": "keyword", "search_phrase": "amatera", "raw_total_exact_sum": 62, "fetched_rows": 60, "months": 10 }, { "set_id": "s_amos_stealer", "kind": "keyword", "search_phrase": "amos stealer", "raw_total_exact_sum": 11, "fetched_rows": 11, "months": 10 }, { "set_id": "s_atomic_stealer", "kind": "keyword", "search_phrase": "atomic stealer", "raw_total_exact_sum": 22, "fetched_rows": 22, "months": 10 }, { "set_id": "s_cloud_logs", "kind": "keyword", "search_phrase": "cloud logs", "raw_total_exact_sum": 1176, "fetched_rows": 1175, "months": 10 }, { "set_id": "s_darkcrystal", "kind": "keyword", "search_phrase": "darkcrystal", "raw_total_exact_sum": 3, "fetched_rows": 3, "months": 10 }, { "set_id": "s_logs_cloud", "kind": "keyword", "search_phrase": "logs cloud", "raw_total_exact_sum": 1419, "fetched_rows": 1419, "months": 10 }, { "set_id": "s_lummac2", "kind": "keyword", "search_phrase": "lummac2", "raw_total_exact_sum": 54, "fetched_rows": 54, "months": 10 }, { "set_id": "s_lunex", "kind": "keyword", "search_phrase": "lunex", "raw_total_exact_sum": 121, "fetched_rows": 113, "months": 10 }, { "set_id": "s_macsync", "kind": "keyword", "search_phrase": "macsync", "raw_total_exact_sum": 388, "fetched_rows": 386, "months": 10 }, { "set_id": "s_mystic_stealer", "kind": "keyword", "search_phrase": "mystic stealer", "raw_total_exact_sum": 21, "fetched_rows": 21, "months": 10 }, { "set_id": "s_phemedrone", "kind": "keyword", "search_phrase": "phemedrone", "raw_total_exact_sum": 5, "fetched_rows": 5, "months": 10 }, { "set_id": "s_private_cloud", "kind": "keyword", "search_phrase": "private cloud", "raw_total_exact_sum": 23182, "fetched_rows": 23102, "months": 10 }, { "set_id": "s_purelogs", "kind": "keyword", "search_phrase": "purelogs", "raw_total_exact_sum": 45, "fetched_rows": 43, "months": 10 }, { "set_id": "s_rhadamanthys", "kind": "keyword", "search_phrase": "rhadamanthys", "raw_total_exact_sum": 41, "fetched_rows": 41, "months": 10 }, { "set_id": "s_risepro", "kind": "keyword", "search_phrase": "risepro", "raw_total_exact_sum": 7, "fetched_rows": 7, "months": 10 }, { "set_id": "s_stealc", "kind": "keyword", "search_phrase": "stealc", "raw_total_exact_sum": 464, "fetched_rows": 461, "months": 10 }, { "set_id": "s_stealer_logs", "kind": "keyword", "search_phrase": "stealer logs", "raw_total_exact_sum": 15316, "fetched_rows": 5169, "months": 10 }, { "set_id": "s_stealer_panel", "kind": "keyword", "search_phrase": "stealer panel", "raw_total_exact_sum": 81, "fetched_rows": 80, "months": 10 }, { "set_id": "s_stealerium", "kind": "keyword", "search_phrase": "stealerium", "raw_total_exact_sum": 23, "fetched_rows": 23, "months": 10 }, { "set_id": "s_traffer", "kind": "keyword", "search_phrase": "traffer", "raw_total_exact_sum": 72, "fetched_rows": 72, "months": 10 }, { "set_id": "s_ulp", "kind": "keyword", "search_phrase": "ulp", "raw_total_exact_sum": 23215, "fetched_rows": 22935, "months": 10 }, { "set_id": "s_vidar", "kind": "keyword", "search_phrase": "vidar", "raw_total_exact_sum": 2549, "fetched_rows": 2461, "months": 10 } ], "monthly_stealer_keyword": [ { "month": "2026-01", "raw_total_exact": 92367, "feed_label_exact": 90621, "known_bots_exact": 121, "remainder": 1625 }, { "month": "2026-02", "raw_total_exact": 78954, "feed_label_exact": 76799, "known_bots_exact": 965, "remainder": 1190 }, { "month": "2026-03", "raw_total_exact": 77350, "feed_label_exact": 74699, "known_bots_exact": 1675, "remainder": 976 }, { "month": "2026-04", "raw_total_exact": 54643, "feed_label_exact": 53700, "known_bots_exact": 54, "remainder": 889 }, { "month": "2026-05", "raw_total_exact": 661, "feed_label_exact": 0, "known_bots_exact": 23, "remainder": 638 }, { "month": "2026-06", "raw_total_exact": 9285, "feed_label_exact": 0, "known_bots_exact": 8773, "remainder": 512 }, { "month": "2026-07", "raw_total_exact": 2479, "feed_label_exact": 0, "known_bots_exact": 1977, "remainder": 502 }, { "month": "2026-08", "raw_total_exact": 810, "feed_label_exact": 0, "known_bots_exact": 221, "remainder": 589 }, { "month": "2026-09", "raw_total_exact": 466, "feed_label_exact": 0, "known_bots_exact": 69, "remainder": 397 }, { "month": "2026-10", "raw_total_exact": 458, "feed_label_exact": 0, "known_bots_exact": 44, "remainder": 414 } ], "limitations": [ "Counts are Blackhole-collected posts (post IDs or distinct texts), not offers, sellers, sales, victims, infections or people.", "The collection is Telegram-dominated; forums are under 1% of the corpus and Tor leak sites are not covered. It does not represent the wider underground.", "A raw keyword count follows notification bots. From January to April one brand's template accounts for 97.5% of raw \"stealer\" posts; a notification is a claim by a seller or bot, not a verified infection.", "Prices are advertised asking terms, kept in the currency as written (a bare $ is a dollar amount with no denomination stated). Nothing was bought or tested; no price is converted, averaged or presented as a market price.", "The 694-post candidate set is purposive. The 393 offer-like posts (56.6%) and the 182 priced ones describe the set, not the trade; the 40 catalogue records are chosen for contrast, so inclusion is not prevalence.", "Classification is by AI agents. Agreement (77.5% exact intent, 37 of 40 offer versus non-offer, 78 of 78 family-role re-code) measures consistency, not accuracy; Brandefense analysts approved the findings.", "Non-priority candidates were classified from short openings and borderline classes (tool versus cloud advert, menu versus spam) are not stable.", "Keyword and class series are not read as trends: classifier labels are not comparable across the May–July 2026 taxonomy break; family monthly totals depend on bots, mirrors and replies. No growth, decline or market-share claim is made.", "Family-role shares describe distinct kept sampled posts per family, not market share; spelling variants and image-only mentions are not found; several family names are ordinary words.", "Windows of seven days or less were used; some were sampled, and a full-fetch label does not certify completeness. October ends on 27 October and late windows may gain posts through back-fill.", "Dates are recorded post dates, not first Brandefense observation. No early-warning lead time, prevented loss or transaction value is established.", "Handles, channel and shop names, contacts, links, wallets, personal data, victim identities, machine data and operational instructions are excluded from every public file; the feed's stealer label is withheld." ], "findings": [ { "id": "F1", "title": "One brand's notification template was 97.5% of all raw \"stealer\" posts from January to April - about 2,700 a day until it stopped on 25 April.", "text": "One brand's notification template was 97.5% of all raw \"stealer\" posts from January to April - about 2,700 a day until it stopped on 25 April. A raw keyword count measures a bot's schedule, not infections.", "evidence": "feed_monthly.csv", "limit": "Telegram-dominated collected posts; a notification is a seller/bot claim, not a verified infection, victim or sale. The feed's brand, label and channels are not published." }, { "id": "F2", "title": "Of 393 offer-like posts, 150 of the 182 that named a price (82%) charged for a time period or a licence, not for the thing itself.", "text": "Of 393 offer-like posts, 150 of the 182 that named a price (82%) charged for a time period or a licence, not for the thing itself. Time-limited access is the dominant unit for log clouds and stealer licences.", "evidence": "offer-catalog.json (review_scope.priced_offer_class_records)", "limit": "See limitations; asking terms or sampled posts, not market measures." }, { "id": "F3", "title": "Within four selected cloud posts, resold \"leak\" logs cost 50-93% of the advertised private or VIP line in the same post, and live-traffic logs 2.9-3.6 times that line.", "text": "Within four selected cloud posts, resold \"leak\" logs cost 50-93% of the advertised private or VIP line in the same post, and live-traffic logs 2.9-3.6 times that line.", "evidence": "offer-catalog.json; offer-price-terms.csv", "limit": "See limitations; asking terms or sampled posts, not market measures." }, { "id": "F4", "title": "A family name usually labels a log for sale or retells news; among distinct, cleaned posts, only 6.2% of read posts naming the four largest families offered the product itself (95% interval 3.4-11.1%).", "text": "A family name usually labels a log for sale or retells news; among distinct, cleaned posts, only 6.2% of read posts naming the four largest families offered the product itself (95% interval 3.4-11.1%).", "evidence": "family_roles.csv", "limit": "See limitations; asking terms or sampled posts, not market measures." }, { "id": "F5", "title": "Posts are not offers: 393 offer-like posts hold 374 distinct texts, 41 template families cover 28% of the posts, and an October cloud advert closely tracked an August one's wording at a different price.", "text": "Posts are not offers: 393 offer-like posts hold 374 distinct texts, 41 template families cover 28% of the posts, and an October cloud advert closely tracked an August one's wording at a different price.", "evidence": "offer-catalog.json; methodology.html", "limit": "See limitations; asking terms or sampled posts, not market measures." } ], "articles": [ { "slug": "infostealer-log-supply-chain-2026", "title": "What stealer sellers actually package", "url": "/blog/infostealer-log-supply-chain-2026/" }, { "slug": "stealer-keyword-bot-spam-2026", "title": "What 92,000 \"stealer\" posts in January really were", "url": "/blog/stealer-keyword-bot-spam-2026/" }, { "slug": "stealer-family-names-in-posts-2026", "title": "What a family name does in a post", "url": "/blog/stealer-family-names-in-posts-2026/" } ], "assets": { "manifest": "infostealer-data.json", "methodology": "methodology.html", "dictionary": "data-dictionary.html", "press": "press-kit.html", "license": "license.html", "catalogue_html": "offer-catalog.html", "catalogue_json": "offer-catalog.json", "catalogue_csv": "offer-catalog.csv", "price_terms_csv": "offer-price-terms.csv", "feed_monthly_csv": "feed_monthly.csv", "sets_monthly_csv": "sets_monthly_infostealer.csv", "family_roles_csv": "family_roles.csv", "family_roles_by_role_csv": "family_roles_by_role.csv", "family_timeline_csv": "family_timeline.csv", "family_mentions_monthly_csv": "family_mentions_monthly.csv", "feed_evidence_json": "feed_evidence.json", "validation_json": "validation.json", "windows_csv": "retrieval-windows.csv", "report_cover": "infostealer-report-cover.png", "charts": [ { "id": "stealer-keyword-bot", "svg": "chart-stealer-keyword-bot.svg", "png": "chart-stealer-keyword-bot.png", "title": "What were the raw \"stealer\" posts?", "alt": "Monthly raw stealer posts January to October 2026. January 92,367 posts, 90,621 carrying one feed label; Jan-Apr 97.5% feed label; from May the total falls below 10,000 and the remainder after subtracting the three identified sources is 397 to 638 posts a month. Collected posts, not infections." }, { "id": "pricing-units", "svg": "chart-pricing-units.svg", "png": "chart-pricing-units.png", "title": "Of 182 priced offer-like posts, how are they priced?", "alt": "150 of 182 priced offer-like posts (82%) charge by access period or licence; 15 per item, volume or quota; 13 flat or bundle; 3 other; 1 percentage. Asking terms in a purposive candidate set." }, { "id": "family-roles", "svg": "chart-family-roles.svg", "png": "chart-family-roles.png", "title": "What does a family name do in a post?", "alt": "Stacked bars of 40 sampled posts each. Product offered: Lumma 1, RedLine 4, Vidar 2, StealC 3. Log label: 6, 10, 19, 16. News retelling: 15, 4, 6, 11. Discussion: 10, 10, 4, 3. Other: 8, 12, 9, 7." }, { "id": "provenance-ladder", "svg": "chart-provenance-ladder.svg", "png": "chart-provenance-ladder.png", "title": "What does recency cost?", "alt": "In four price lists the resold line costs 70, 50, 93 and 65 percent of the private line; live-traffic lines cost 3.6, 2.9 and 3.5 times the private line. Asking prices, within-post ratios." } ], "social": { "social-cover": "social-cover.png", "social-pricing-unit": "social-pricing-unit.png", "social-family-name": "social-family-name.png", "social-provenance-premium": "social-provenance-premium.png" }, "reader": "../report/infostealer-report-2026.html" }, "ai_disclosure": "Brandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.", "method_box": "Why AI agents. Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone. Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed. Brandefense analysts reviewed and approved the findings.", "license": "CC BY 4.0 for original aggregates, charts and editorial paraphrases; raw source content is excluded.", "attribution": "Source: Brandefense Research Team, Infostealers (Cybercrime Report 2026), v1.0. Data: Brandefense Blackhole, 1 Jan–27 Oct 2026. Observed posts and advertised terms, not market totals." }