# Infostealer Activity Weekly Report (2026-11-02 to 2026-11-09): 12,382 Compromised Machines, Lumma/Warden/Vidar

> Hudson Rock's weekly infostealer telemetry for 2026-11-02 to 2026-11-09 reports 12,382 compromised machines, 2,221 compromised employees, 2,896 compromised users and 7,265 compromised Androids. Named families are Lumma (136 machines), Warden Stealer (4) and Vidar (1), plus 12,218 machines classed as Generic Stealer.

- **Published:** 2026-11-10T01:07:21Z
- **Last reviewed:** 2026-11-10T01:07:21Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5609
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5609.png
- **ID:** TL-2026-5609
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 8

## Description

This record documents aggregate infostealer telemetry published by Hudson Rock (Infostealers.com) on 2026-11-09 for the period 2026-11-02 to 2026-11-09. The report counts 12,382 compromised machines, 2,221 compromised employees, 2,896 compromised users, 7,265 compromised Android devices and 78,041 compromised domains across 147 countries. Stealer families by machine count are Generic Stealer (12,218), Lumma/LummaC2 (136), Warden Stealer (4) and Vidar (1); the family counts total 12,359 and do not sum exactly to the headline figure.

Geographically the infections concentrate in India (3,068), Pakistan (520), Vietnam (414), Bangladesh (394) and Brazil (234); the United States has 84. The most exposed accounts are consumer and SaaS services: google.com (8,930 users), facebook.com (5,957), live.com (4,613), instagram.com (4,566), microsoftonline.com (1,904), openai.com (1,830) and github.com (1,159). Android exposure is led by Facebook (3,778), Instagram (3,424), Netflix (2,089) and Snapchat (1,891). Corporate exposure includes hostinger.com (110 employees), rediff.com (107), icicibank.com (104), several Indian banking and government domains, and a small number of S&P-listed companies (for example salesforce.com 12, ibm.com 5, microsoft.com 5).

The report lists keywords hit in stolen data, which indicate that the stolen material includes authentication and remote-access context: auth (30,875), sso (7,032), zoom (2,825), github (2,006), sap (1,082), salesforce (866), adfs (746), oracle (652), webmail (312), vpn (306), owa (191), okta (151) and sharepoint (31). Endpoint protection on infected machines was mostly Windows Defender (9,775, plus 377 listed as 'WindowsDefender'), with 1,258 machines reporting no AV, followed by Malwarebytes (74), Avast (72), Kaspersky (61), ESET (12) and Trend Micro (5). The page gives no OS breakdown; the Defender counts imply Windows hosts alongside the Android devices.

The source lists no CVEs, threat actors, IPs, domains used as C2, file hashes or specific TTPs, so no such indicators are asserted here. Prior weekly figures on the same site show a decline: 35K machines (Oct 12-19), 28K (Oct 19-26) and 26K (Oct 26-Nov 2) before this week's 12,382. The source has internal inconsistencies (Facebook 5,957 vs 5,973; 'Windows Defender' vs 'WindowsDefender'; 'None' vs 'None detected'), so figures should be treated as approximate. Independent reporting (Flashpoint mid-2026) ranks Vidar, StealC and Lumma (including clones such as Remus) as the most prolific families in January-June 2026; no independent source on Warden Stealer was found. This record is a low-confidence trend and context entry for the infostealer credential-theft threat.

## MITRE ATT&CK

- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1528 Steal Application Access Token
- T1005 Data from Local System
- T1518.001 Security Software Discovery
- T1217 Browser Information Discovery
- T1078 Valid Accounts

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Infostealer Browser Credential and Cookie Store Access by Non-Browser Process (Lumma/Vidar/Warden)** (`TL-2026-5609-SPL-001`)

Detects a process other than the browser itself opening Chromium or Firefox credential (Login Data, logins.json, key4.db), cookie and autofill databases on Windows. This is the core T1555.003 / T1539 behaviour of Lumma (LummaC2), Vidar, Warden Stealer and generic stealers reported in TL-2026-5609 (12,382 compromised machines). Behaviour-first; requires SACL auditing on browser profile folders (Security 4663).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1555.003, T1539, T1005
- **Data sources:** windows_security (index=wineventlog, sourcetype=WinEventLog:Security, EventCode 4663), SecurityEvent (Microsoft Sentinel)
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4663 earliest=-24h (Object_Name="*Chrome*User Data*Login Data" OR Object_Name="*Chrome*User Data*Cookies" OR Object_Name="*Chrome*User Data*Web Data" OR Object_Name="*Edge*User Data*Login Data" OR Object_Name="*Edge*User Data*Cookies" OR Object_Name="*Edge*User Data*Web Data" OR Object_Name="*Brave-Browser*User Data*Login Data" OR Object_Name="*Brave-Browser*User Data*Cookies" OR Object_Name="*Firefox*Profiles*logins.json" OR Object_Name="*Firefox*Profiles*key4.db" OR Object_Name="*Firefox*Profiles*cookies.sqlite") NOT (Process_Name="*chrome.exe" OR Process_Name="*msedge.exe" OR Process_Name="*firefox.exe" OR Process_Name="*brave.exe" OR Process_Name="*opera.exe" OR Process_Name="*MsMpEng.exe")
| eval store=case(match(Object_Name,"(?i)Login Data|logins[.]json|key4[.]db"),"credential_store",match(Object_Name,"(?i)Cookies|cookies[.]sqlite"),"cookie_store",true(),"autofill_store")
| stats dc(Object_Name) as stores_touched values(store) as store_types values(Object_Name) as objects min(_time) as first_seen max(_time) as last_seen by host Account_Name Process_Name
| where stores_touched>=2
| eval threat_id="TL-2026-5609", technique="T1555.003,T1539", first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table first_seen last_seen host Account_Name Process_Name store_types stores_touched objects threat_id technique
```

### Microsoft KQL

```kql
SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4663
| where ObjectName matches regex @"(?i)(Chrome|Edge|Brave-Browser).*User Data.*(Login Data|Cookies|Web Data)$|Firefox.*Profiles.*(logins[.]json|key4[.]db|cookies[.]sqlite)$"
| where not(ProcessName endswith "chrome.exe" or ProcessName endswith "msedge.exe" or ProcessName endswith "firefox.exe" or ProcessName endswith "brave.exe" or ProcessName endswith "opera.exe" or ProcessName endswith "MsMpEng.exe")
| summarize StoresTouched = dcount(ObjectName), Objects = make_set(ObjectName, 10), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Computer, SubjectUserName, ProcessName
| where StoresTouched >= 2
| project FirstSeen, LastSeen, Computer, SubjectUserName, ProcessName, StoresTouched, Objects
```

### Sigma

```yaml
title: Non-Browser Process Access to Browser Credential and Cookie Stores
id: 5b1e0c3a-5609-4d11-9a01-0a1b2c3d4e01
status: experimental
description: Detects a non-browser process opening Chromium or Firefox credential, cookie or autofill databases, behaviour of Lumma, Vidar, Warden Stealer and generic infostealers in TL-2026-5609. Requires object access auditing on browser profile folders.
references:
    - https://www.infostealers.com/report/infostealers-weekly-report-2026-11-02-2026-11-09/
    - https://attack.mitre.org/techniques/T1555/003/
author: Threadlinqs Team
date: 2026-11-10
tags:
    - attack.credential-access
    - attack.t1555.003
    - attack.t1539
    - attack.collection
    - attack.t1005
logsource:
    product: windows
    service: security
detection:
    selection_event:
        EventID: 4663
    selection_chromium:
        ObjectName|contains: 'User Data'
        ObjectName|endswith:
            - 'Login Data'
            - 'Cookies'
            - 'Web Data'
    selection_firefox:
        ObjectName|contains: 'Firefox'
        ObjectName|endswith:
            - 'logins.json'
            - 'key4.db'
            - 'cookies.sqlite'
    filter_browsers:
        ProcessName|endswith:
            - 'chrome.exe'
            - 'msedge.exe'
            - 'firefox.exe'
            - 'brave.exe'
            - 'opera.exe'
            - 'MsMpEng.exe'
    condition: selection_event and (selection_chromium or selection_firefox) and not filter_browsers
falsepositives:
    - Backup, EDR and DLP agents that read browser profiles
    - Browser migration or profile sync utilities
    - Forensic collection tools run by IR staff
level: high

```

**Known false positives:**

- Backup, DLP or EDR agents that scan browser profile directories
- Browser data migration or import tools run by users or IT
- Incident-response triage collecting browser artifacts

**Tuning notes:** Enable object-access auditing (SACL) on the browser profile folders first, otherwise 4663 will not fire. Add approved backup/EDR binaries to the NOT clause. Raise the stores_touched threshold on noisy endpoints and correlate hits with outbound network activity from the same Process_Name.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ClickFix-Style Download Cradle from Explorer (Lumma Delivery) (locked: unlock with TL Creds)
- Stolen Session Replay: Multi-Country or Multi-Device Successful Sign-Ins in One Hour (locked: unlock with TL Creds)
- Stealer Exfiltration: Web Connections from User-Writable Path Binaries (locked: unlock with TL Creds)
- Browser Remote-Debugging Launch by Unexpected Parent (Stealer Cookie/Token Theft) (locked: unlock with TL Creds)
- Security Software Discovery via WMI/PowerShell (Stealer Pre-Check) (locked: unlock with TL Creds)
- Stealer C2 Dead-Drop Resolution via Steam/Telegram from User-Writable Path (locked: unlock with TL Creds)
- Stealer Discovery and Collection Scoring: AV Enumeration, Browser Data Enumeration, Staging (locked: unlock with TL Creds)
- Community-Reported Stealer Infrastructure: 5tr.org, 7k.iakmialor.web.id, 37.27.4.20 and Hashes (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Infostealers Weekly Report: 2026-11-02 to 2026-11-09 (Hudson Rock)](https://www.infostealers.com/report/infostealers-weekly-report-2026-11-02-2026-11-09/)
- [Flashpoint Global Threat Intelligence Report Midyear 2026: Information-Stealing Malware Threats](https://flashpoint.io/resources/report/flashpoint-global-threat-intelligence-report-midyear-2026/information-stealing-malware-threats/)
- [Infostealers Harvest 1.7 Billion Credentials in Six Months (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/infostealers-17-billion/)
- [Lumma Stealer Activity Drops After Doxxing (SecurityWeek)](https://www.securityweek.com/lumma-stealer-activity-drops-after-doxxing/)
- [Top Infostealer Malware in 2026: Stealer Logs, Families, and What to Do (GridinSoft)](https://blog.gridinsoft.com/infostealer-malware-top/)
- [From Stealers to Systems: The New Model of Credential Theft (Trend Micro)](https://trendmicro.com/vinfo/gb/security/news/cybercrime-and-digital-threats/from-stealers-to-systems-the-new-model-of-credential-theft)
- [Infostealers: The Malware That Breaks in Without Breaking Anything (CybelAngel)](https://cybelangel.com/blog/infostealers-the-malware-that-breaks-in-without-breaking-anything/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5609