Infostealers harvested 1.7 billion credentials in six months as Vidar and Lumma dominate

Between January and June 2026, infostealer malware harvested 1.7 billion credentials from 7.4 million infected devices — a 27% increase in infections over the preceding six months. Vidar, StealC and Lumma account for the bulk of observed activity.

Those numbers are large enough to be abstract. The concrete version: infostealers are now the single most productive supplier of initial access to the criminal economy, and most of what they steal is not passwords.

The credential is not the prize anymore

A stolen password is an inconvenience. It gets rotated, and if MFA is enforced it may not even work in the first place. What makes modern infostealer output valuable is everything else in the log:

• Session cookies. An authenticated session token imported into an attacker's browser skips the login flow entirely — no password, no MFA prompt, no anomalous-login alert.
• Browser-stored credentials, including the corporate SSO passwords that people save on personal machines.
• Cryptocurrency wallet files and browser extension data.
• Local configuration files — VPN profiles, RDP connection files, cloud CLI credential caches, SSH keys.
• System fingerprint data that lets an attacker replicate the victim's device characteristics closely enough to defeat some risk-based authentication.

If your response to an infostealer detection is "we reset the user's password," you have addressed the least valuable thing that was taken.

A fully industrialised market

The infostealer landscape has transformed into an automated threat ecosystem. The division of labour is now clean:

• Developers build and maintain the stealer, and sell access on a subscription basis. Void Stealer, which emerged in late 2025 and has run active campaigns throughout 2026, is distributed as Malware-as-a-Service through Telegram channels and underground forums for a monthly fee.
• Traffers handle distribution — running SEO poisoning campaigns, buying malvertising, seeding fake installers.
• Log marketplaces aggregate, index and resell the output, sorted by geography, corporate domain and the presence of specific SaaS sessions.
• Initial access brokers buy corporate logs, validate access and sell it on to ransomware affiliates.

Each layer is a business with its own customers. That is why volume keeps rising: nobody in the chain needs to be sophisticated, because someone else has already solved their part of the problem.

Delivery: mostly boring, entirely effective

In June 2026, families including Remus, ACRStealer, LummaC2 and Vidar were actively distributed through SEO poisoning and disguised as pirated or cracked software, with EXE files and DLL side-loading as the primary infection vectors.

A separate campaign starting 26 June 2026 impersonated hundreds of brands on GitHub, routing victims through SEO-optimised search results toward malicious downloads. Using GitHub as the hosting layer is effective for the same reason it is hard to block: the domain is trusted, the TLS certificate is valid, and most egress filters allow it because developers need it.

There is also a steady stream of ClickFix-style social engineering, including a campaign using fake macOS utility lures to deliver infostealers. ClickFix works by showing the victim a fake error and instructing them to paste a command into a terminal to "fix" it — the victim performs the compromise themselves, which neatly sidesteps a lot of download-based controls.

What defenders should change

Treat session tokens as credentials

Shorten session lifetimes for privileged applications. Bind sessions to device posture where your identity provider supports it. Most importantly, make sure your incident response process includes revoking sessions, not just resetting passwords — in Entra ID, Okta and Google Workspace these are separate actions, and teams routinely do the first and forget the second.

Break the personal-device bridge

A large share of corporate credential exposure comes from infections on unmanaged personal machines where someone signed into a work SaaS app. Conditional access policies that require a managed, compliant device for corporate applications cut this path off at the root. It is unpopular and it works.

Monitor for your own logs

Credential monitoring services track stealer log marketplaces for your corporate domain. This is one of the few areas where a commercial feed produces genuinely actionable output: a hit tells you a specific user's session material is in criminal hands right now.

Block the delivery path

• Application allowlisting on endpoints where it is feasible — it defeats almost all EXE-based stealers.
• Aggressive filtering on newly registered domains and known malvertising infrastructure.
• User education specifically about ClickFix: no legitimate error message ever asks you to paste a command into PowerShell or Terminal.

The uncomfortable maths

At 7.4 million infected devices per half-year and rising, the assumption that your users' credentials are uncompromised is not a defensible one. The design goal has to shift from preventing credential theft — which is not achievable at that scale — to making stolen credentials insufficient. Phishing-resistant MFA, device-bound sessions and tight conditional access are what that looks like in practice.