Happy New Year!
A brief look at all things infostealers for the week 1, 2026 (29.12.2025–04.01.2026). Updates in MioLab stealers. Grabbed some numbers from marketplaces and few interesting news/articles for you to read.
It was a strange week, starting in last year 🙂 This update is a very quick one, even lower in quality than usual, but in my defence I have been travelling a lot. Most likely, I have missed more stuff, I’ll try to catch up on the 2nd week overview.
Infostealer Updates
MioLab Stealer
Happy New Year to everyone!
- DMG Preview has been added when creating a DMG build. Now, you can move the icon in real time and see how your background ‘fits’.
- The ClickFix section has been added with the ability to set up a build with your own settings.
- An API for Team has been added (details and cost in PM).
Creating Unix / DMG builds
Obtaining / Downloading a list of logs
Downloading builds - Fixed the display of services in the Logs tab.
- Fixed the proxy error in the Restore Google Cookies tab.
- Fixed the incorrect display of wallets (now all wallets in the log are shown).
- Fixed a bug with the build name, which was pulling up old settings.
Screenshot taken from MioLab Products Telegram channel
Marketplace Updates
This section provides some numbers taken from the marketplaces, which include numbers of victims based on stealers, top 5 countries, the victim numbers in the countries of the Nordic region. In addition, see the CryptPad spreadsheet for all more broad numbers.
Marketplace Updates Spreadsheet 2026
The below spreadsheet contains meaningless numbers taken in 2025:
Marketplace Updates Spreadsheet 2025
Russian Market
Stealers by number of victims
| Stealer name | Number of victims |
|---|---|
| Lumma | 7,012,811 |
| Vidar | 900,197 |
| Acreed | 842,687 |
| StealC | 806,392 |
| Rhadamanthys | 514,220 |
| RedLine | 192,116 |
| RisePro | 145,530 |
| Raccoon | 5,078 |
Top 5 countries by number of victims
| Country | Number of victims |
|---|---|
| India | 1,208,683 |
| Brazil | 746,360 |
| Indonesia | 568,161 |
| Egypt | 489,921 |
| Pakistan | 417,284 |
Nordic region countries
| Country | Number of victims |
|---|---|
| Sweden | 22,917 |
| Denmark | 12,534 |
| Norway | 10,304 |
| Finland | 8,434 |
| Iceland | 1,140 |
| Greenland | 156 |
| Faroe | 111 |
| Åland | 24 |
Exodus Market
Stealers by number of victims
| Stealer name | Number of victims |
|---|---|
| StealC | 9,588 |
| Vidar | 7,433 |
| Lumma | 6,656 |
| Rhadamanthys | 6,427 |
| RedLine | 3 |
Top 5 countries by number of victims
| Country | Number of victims |
|---|---|
| India | 4,066 |
| Brazil | 2,108 |
| Turkey | 1,789 |
| USA | 1,745 |
| Bangladesh | 1,685 |
Nordic region countries
| Country | Number of victims |
|---|---|
| Sweden | 94 |
| Norway | 46 |
| Denmark | 43 |
| Finland | 34 |
| Iceland | 4 |
Articles/News
Dissecting a Multi-Stage macOS Infostealer
- https://blog.threatuniverse.co.uk/posts/usersyncworker-macos-infostealer/
Additional Notes on the Trevor Greer Infostealer Logs
- https://nkinternet.com/2025/12/16/additional-notes-on-the-trevor-greer-infostealer-logs/
Zoom Stealer browser extensions harvest corporate meeting intelligence
- https://www.bleepingcomputer.com/news/security/zoom-stealer-browser-extensions-harvest-corporate-meeting-intelligence/
Infostealer Malware Delivered in EmEditor Supply Chain Attack
- https://www.securityweek.com/infostealer-malware-delivered-in-emeditor-supply-chain-attack/