Threat reportMalwareTL-2026-5609
Infostealer Activity Weekly Report (2026-11-02 to 2026-11-09): 12,382 Compromised Machines, Lumma/Warden/Vidar
Hudson Rock's weekly infostealer telemetry for 2026-11-02 to 2026-11-09 reports 12,382 compromised machines, 2,221 compromised employees, 2,896 compromised users and 7,265 compromised Androids. Named families are Lumma (136 machines), Warden Stealer (4) and Vidar (1), plus 12,218 machines classed as Generic Stealer.
Key facts
| Identifiers | TL-2026-5609 |
|---|---|
| Also known as | Hudson Rock Weekly Infostealer Report 2026-11-02 to 2026-11-09 |
| Severity | MEDIUM |
| First disclosed | |
| Affected products | Microsoft Windows (endpoints infected by infostealers); Google Android (7,265 compromised devices) |
| Malware | Generic Stealer, Lumma, LummaC2, Redline, Remus Stealer, Vidar, Warden Stealer |
| MITRE ATT&CK techniques | T1005 Data from Local System, T1078 Valid Accounts, T1217 Browser Information Discovery, T1518.001 Security Software Discovery, T1528 Steal Application Access Token, T1539 Steal Web Session Cookie, T1555.003 Credentials from Web Browsers |
| Motivation | FINANCIAL |
| Target sectors | consumer, finance, government administration, technology, education |
| Target regions | South Asia, Southeast Asia, Latin America, Africa, Middle East |
| Detection rules | 9 (1 shown free) |
| Sources | 7 cited sources |
Detection coverage
As of 2026-11-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5609 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: Infostealer Browser Credential and Cookie Store Access by Non-Browser Process (Lumma/Vidar/Warden)
Detects a process other than the browser itself opening Chromium or Firefox credential (Login Data, logins.json, key4.db), cookie and autofill databases on Windows. This is the core T1555.003 / T1539 behaviour of Lumma (LummaC2), Vidar, Warden Stealer and generic stealers reported in TL-2026-5609 (12,382 compromised machines). Behaviour-first; requires SACL auditing on browser profile folders (Security 4663).
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1555.003, T1539, T1005
- Data sources: windows_security (index=wineventlog, sourcetype=WinEventLog:Security, EventCode 4663), SecurityEvent (Microsoft Sentinel)
- Severity: high
- Confidence: high
Splunk SPL
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4663 earliest=-24h (Object_Name="*Chrome*User Data*Login Data" OR Object_Name="*Chrome*User Data*Cookies" OR Object_Name="*Chrome*User Data*Web Data" OR Object_Name="*Edge*User Data*Login Data" OR Object_Name="*Edge*User Data*Cookies" OR Object_Name="*Edge*User Data*Web Data" OR Object_Name="*Brave-Browser*User Data*Login Data" OR Object_Name="*Brave-Browser*User Data*Cookies" OR Object_Name="*Firefox*Profiles*logins.json" OR Object_Name="*Firefox*Profiles*key4.db" OR Object_Name="*Firefox*Profiles*cookies.sqlite") NOT (Process_Name="*chrome.exe" OR Process_Name="*msedge.exe" OR Process_Name="*firefox.exe" OR Process_Name="*brave.exe" OR Process_Name="*opera.exe" OR Process_Name="*MsMpEng.exe")
| eval store=case(match(Object_Name,"(?i)Login Data|logins[.]json|key4[.]db"),"credential_store",match(Object_Name,"(?i)Cookies|cookies[.]sqlite"),"cookie_store",true(),"autofill_store")
| stats dc(Object_Name) as stores_touched values(store) as store_types values(Object_Name) as objects min(_time) as first_seen max(_time) as last_seen by host Account_Name Process_Name
| where stores_touched>=2
| eval threat_id="TL-2026-5609", technique="T1555.003,T1539", first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table first_seen last_seen host Account_Name Process_Name store_types stores_touched objects threat_id techniqueMicrosoft KQL
SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4663
| where ObjectName matches regex @"(?i)(Chrome|Edge|Brave-Browser).*User Data.*(Login Data|Cookies|Web Data)$|Firefox.*Profiles.*(logins[.]json|key4[.]db|cookies[.]sqlite)$"
| where not(ProcessName endswith "chrome.exe" or ProcessName endswith "msedge.exe" or ProcessName endswith "firefox.exe" or ProcessName endswith "brave.exe" or ProcessName endswith "opera.exe" or ProcessName endswith "MsMpEng.exe")
| summarize StoresTouched = dcount(ObjectName), Objects = make_set(ObjectName, 10), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Computer, SubjectUserName, ProcessName
| where StoresTouched >= 2
| project FirstSeen, LastSeen, Computer, SubjectUserName, ProcessName, StoresTouched, ObjectsSigma
title: Non-Browser Process Access to Browser Credential and Cookie Stores
id: 5b1e0c3a-5609-4d11-9a01-0a1b2c3d4e01
status: experimental
description: Detects a non-browser process opening Chromium or Firefox credential, cookie or autofill databases, behaviour of Lumma, Vidar, Warden Stealer and generic infostealers in TL-2026-5609. Requires object access auditing on browser profile folders.
references:
- https://www.infostealers.com/report/infostealers-weekly-report-2026-11-02-2026-11-09/
- https://attack.mitre.org/techniques/T1555/003/
author: Threadlinqs Team
date: 2026-11-10
tags:
- attack.credential-access
- attack.t1555.003
- attack.t1539
- attack.collection
- attack.t1005
logsource:
product: windows
service: security
detection:
selection_event:
EventID: 4663
selection_chromium:
ObjectName|contains: 'User Data'
ObjectName|endswith:
- 'Login Data'
- 'Cookies'
- 'Web Data'
selection_firefox:
ObjectName|contains: 'Firefox'
ObjectName|endswith:
- 'logins.json'
- 'key4.db'
- 'cookies.sqlite'
filter_browsers:
ProcessName|endswith:
- 'chrome.exe'
- 'msedge.exe'
- 'firefox.exe'
- 'brave.exe'
- 'opera.exe'
- 'MsMpEng.exe'
condition: selection_event and (selection_chromium or selection_firefox) and not filter_browsers
falsepositives:
- Backup, EDR and DLP agents that read browser profiles
- Browser migration or profile sync utilities
- Forensic collection tools run by IR staff
level: high
Known false positives:
- Backup, DLP or EDR agents that scan browser profile directories
- Browser data migration or import tools run by users or IT
- Incident-response triage collecting browser artifacts
Tuning notes: Enable object-access auditing (SACL) on the browser profile folders first, otherwise 4663 will not fire. Add approved backup/EDR binaries to the NOT clause. Raise the stores_touched threshold on noisy endpoints and correlate hits with outbound network activity from the same Process_Name.
- ClickFix-Style Download Cradle from Explorer (Lumma Delivery) · unlock with TL Creds
- Stolen Session Replay: Multi-Country or Multi-Device Successful Sign-Ins in One Hour · unlock with TL Creds
- Stealer Exfiltration: Web Connections from User-Writable Path Binaries · unlock with TL Creds
- Browser Remote-Debugging Launch by Unexpected Parent (Stealer Cookie/Token Theft) · unlock with TL Creds
- Security Software Discovery via WMI/PowerShell (Stealer Pre-Check) · unlock with TL Creds
- Stealer C2 Dead-Drop Resolution via Steam/Telegram from User-Writable Path · unlock with TL Creds
- Stealer Discovery and Collection Scoring: AV Enumeration, Browser Data Enumeration, Staging · unlock with TL Creds
- Community-Reported Stealer Infrastructure: 5tr.org, 7k.iakmialor.web.id, 37.27.4.20 and Hashes · unlock with TL Creds
Indicators of compromise
As of 2026-11-10, Threadlinqs Intelligence tracks 8 indicators of compromise for TL-2026-5609.
Technical analysis
This record documents aggregate infostealer telemetry published by Hudson Rock (Infostealers.com) on 2026-11-09 for the period 2026-11-02 to 2026-11-09. The report counts 12,382 compromised machines, 2,221 compromised employees, 2,896 compromised users, 7,265 compromised Android devices and 78,041 compromised domains across 147 countries. Stealer families by machine count are Generic Stealer (12,218), Lumma/LummaC2 (136), Warden Stealer (4) and Vidar (1); the family counts total 12,359 and do not sum exactly to the headline figure.
Geographically the infections concentrate in India (3,068), Pakistan (520), Vietnam (414), Bangladesh (394) and Brazil (234); the United States has 84. The most exposed accounts are consumer and SaaS services: google.com (8,930 users), facebook.com (5,957), live.com (4,613), instagram.com (4,566), microsoftonline.com (1,904), openai.com (1,830) and github.com (1,159). Android exposure is led by Facebook (3,778), Instagram (3,424), Netflix (2,089) and Snapchat (1,891). Corporate exposure includes hostinger.com (110 employees), rediff.com (107), icicibank.com (104), several Indian banking and government domains, and a small number of S&P-listed companies (for example salesforce.com 12, ibm.com 5, microsoft.com 5).
The report lists keywords hit in stolen data, which indicate that the stolen material includes authentication and remote-access context: auth (30,875), sso (7,032), zoom (2,825), github (2,006), sap (1,082), salesforce (866), adfs (746), oracle (652), webmail (312), vpn (306), owa (191), okta (151) and sharepoint (31). Endpoint protection on infected machines was mostly Windows Defender (9,775, plus 377 listed as 'WindowsDefender'), with 1,258 machines reporting no AV, followed by Malwarebytes (74), Avast (72), Kaspersky (61), ESET (12) and Trend Micro (5). The page gives no OS breakdown; the Defender counts imply Windows hosts alongside the Android devices.
The source lists no CVEs, threat actors, IPs, domains used as C2, file hashes or specific TTPs, so no such indicators are asserted here. Prior weekly figures on the same site show a decline: 35K machines (Oct 12-19), 28K (Oct 19-26) and 26K (Oct 26-Nov 2) before this week's 12,382. The source has internal inconsistencies (Facebook 5,957 vs 5,973; 'Windows Defender' vs 'WindowsDefender'; 'None' vs 'None detected'), so figures should be treated as approximate. Independent reporting (Flashpoint mid-2026) ranks Vidar, StealC and Lumma (including clones such as Remus) as the most prolific families in January-June 2026; no independent source on Warden Stealer was found. This record is a low-confidence trend and context entry for the infostealer credential-theft threat.
MITRE ATT&CK techniques by tactic:
Collection
Initial Access
Discovery
T1217 Browser Information Discovery; T1518.001 Security Software Discovery
Credential Access
T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers
Remediation
Immediate actions
- Reset passwords and revoke active sessions, cookies and OAuth/SSO tokens for any user or employee identified in infostealer exposure data
- Check corporate domains and employees against infostealer exposure monitoring (for example Hudson Rock Cavalier or its free exposure check)
- Re-image or run full EDR remediation on hosts confirmed infected with Lumma, Vidar, Warden Stealer or generic stealers
Workarounds
- Block personal-device access to corporate SSO and VPN, and require managed devices for admin and SaaS access
- Alert on impossible-travel and new-device logins following credential exposure
Longer-term hardening
- Enforce phishing-resistant MFA and short session lifetimes on SSO, ADFS, VPN, Okta and webmail
- Use device-bound session credentials or conditional access to limit replay of stolen cookies
- Deploy EDR with behavioral detection of browser credential-store and cookie-database access
- Do not allow corporate credentials to be saved in personal or unmanaged browsers
Affected and fixed versions
Timeline
- Hudson Rock weekly report for 2026-10-12 to 2026-10-19 lists about 35K compromised machines, 11K users and 388K domains.
- Weekly report for 2026-10-19 to 2026-10-26 lists about 28K compromised machines, 6K users and 361K domains.
- Start of the reporting window; infostealer infections counted for 12,382 machines through 2026-11-09.
- Weekly report for 2026-10-26 to 2026-11-02 lists about 26K compromised machines, 6K users and 270K domains.
- Hudson Rock publishes the weekly infostealer report on Infostealers.com, naming Lumma (136), Warden Stealer (4), Vidar (1) and Generic Stealer (12,218).
- Reporting window closes with 12,382 compromised machines, 2,221 employees, 2,896 users, 7,265 Androids and 78,041 domains.
Sources cited
- Infostealers Weekly Report: 2026-11-02 to 2026-11-09 (Hudson Rock) infostealers.com · Research · 2026-11-09
- Flashpoint Global Threat Intelligence Report Midyear 2026: Information-Stealing Malware Threats flashpoint.io · Research
- From Stealers to Systems: The New Model of Credential Theft (Trend Micro) Trend Micro · Vendor report
- Top Infostealer Malware in 2026: Stealer Logs, Families, and What to Do (GridinSoft) blog.gridinsoft.com · Blog
- Infostealers: The Malware That Breaks in Without Breaking Anything (CybelAngel) cybelangel.com · Blog
- Infostealers Harvest 1.7 Billion Credentials in Six Months (Infosecurity Magazine) infosecurity-magazine.com · News
- Lumma Stealer Activity Drops After Doxxing (SecurityWeek) SecurityWeek · News
Previous and next in malware
Drafted by the Threadlinqs research pipeline from 7 sources; published ; last updated —.
