Security researchers recorded 7.4 million devices infected with infostealer malware in the first half of 2026, a 27% increase from the previous six months, according to Flashpoint data.
The threat intelligence company revealed the news in its 2026 Global Threat Intelligence Report: Midyear Edition, which features information collected from deep and dark web forums, illicit marketplaces, encrypted channels, and threat actor-linked infrastructure and ecosystems.
In total, it claimed that hackers harvested 1.7 billion credentials via infostealer malware between January and June 2026, with Vidar, StealC and Lumma the top three most prolific infostealer variants.
The infostealer landscape has now transformed into a fully automated threat ecosystem, Flashpoint claimed.
“These systems do not require constant human oversight; instead, they function as autonomous credential processing engines capable of ingestion and orchestration at machine speed. This evolution redefines the lifecycle of a breach,” the report explained.
“Threat networks are now connecting these malicious agents directly to raw log supply chains. Once infostealer families harvest data, these systems immediately ingest records, parsing out high-value metadata, and automatically initiate parallel credential stuffing and active session testing across thousands of environments simultaneously.”
Read more on infostealers: Novel macOS Infostealer AmnesiaStealer Spread via ClickFix
Although the figures describe the prominent role of identity as an attack surface, the report also pointed to the continued proliferation of software vulnerabilities.
Flashpoint tracked 21,667 vulnerability disclosures over the period: an 8% increased from the previous six months. Nearly one in five (19%) flaws was accompanied by public or functional exploit code.
However, of this number, only a small percentage were actually exploited. Flashpoint’s Known Exploited Vulnerabilities (KEV) catalog tracked 239 flaws undergoing active, in-the-wild exploitation during H1 2026. That’s 191% more than the 82 flaws identified by the federal CISA KEV list, Flashpoint claimed.
The vendor also asserted that its team was able to isolate 6808 vulnerabilities for customers before they were even published by the National Vulnerability Database (NVD).
Malicious AI Activity Surges Underground
The underground markets that support the trade in both infostealers and software vulnerabilities are being shaped by the rapid rise of AI threats.
Over the period, Flashpoint captured over 22 million posts related to malicious use of AI on illicit forums and closed-chat channels.
With commoditized access to open source AI, many threat actors are deploying tooling locally, meaning they don’t need to rely on public underground networks or specially built deployment services, the report claimed.
“However, for those that do still need these services, cybercrime-trained AI offerings remain overwhelmingly concentrated within rapid-delivery messaging platforms and open-source infrastructure,” it continued.
“These platforms, such as Telegram, are commonly utilized by illicit communities, followed by Reddit, GitHub, and Pastebin.”
Such channels have effectively become a distribution layer for malware, social engineering scripts and more, Flashpoint noted.
Elsewhere in the report, Flashpoint counted 6256 ransomware victims in the first six months of this year – a 45% increase from the previous six months. This trend is being driven by automation, low-cost initial access and a mature ransomware-as-a-service (RaaS) ecosystem.
However, as has been noted elsewhere, fewer organizations are paying their extorters.
