• Infostealer Malware
• Threat Intelligence
• Dark Web Monitoring
• Stolen Credentials

Infostealer Attacks in August 2026: Monthly Report

How many passwords an infostealer steals from one machine, and why resetting the account your alert specifies isn’t enough.

381,088 of August’s infected machines ran a Windows Enterprise edition, which only comes through volume licensing. That’s close to a third of the machines we indexed.

We index infostealer logs as they’re leaked or sold on private Telegram channels and criminal marketplaces.

This is the first month of the series, so there’s no month-over-month comparison yet. The methodology note at the end sets out what we counted and what we left out.

Here’s what the August 2026 numbers show.

August 2026 infostealer numbers at a glance

August is the first month we’ve published infostealer volume, so these numbers are the baseline the rest of the series gets measured against.

• 1,217,555 infected machines in the infostealer logs we indexed
• 27 saved logins taken from the typical machine
• 133,005,847 credential records, holding 57,979,449 distinct username and password pairs
• 612,096 email domains appeared in the stolen usernames
• 176,784 machines held a Microsoft 365 credential
• 384,955,693 cookies captured from the same logs

These numbers cover the infostealer logs we index, not every infection out there.

One infection leaks 27 stolen logins, not one

The typical machine in August had 27 saved logins taken from it. A quarter of machines lost more than 87 credentials. One in ten lost more than 202.

The average works out at 85, but a handful of enormous logs increased that number. Most machines leaked nowhere near that.

When one of your employees turns up in a stealer log, you’re not looking at the single account that triggered the alert. You need to reset everything that was saved in that person’s browser.

Two-thirds of stolen credentials have no malware family defined

Of August’s 133,005,847 credential records, 44,728,743 arrived with a malware family defined. That’s a third. For the remaining 88 million, the logs say nothing about which family took them.

Those top four families account for 96.5% of everything we could attribute.

Those percentages are shares of the 44.7 million credentials that included a label, not of the full 133 million records.

A third of the infections were on work machines

1,205,794 of the infected machines reported which version of Windows they were running. 381,088 of those ran an Enterprise edition.

Enterprise editions aren’t sold in shops. You get them through volume licensing, which means somebody’s IT department bought and deployed them. Another 296,607 machines ran a Home edition. Windows Pro was the largest group at 406,134, but it tells you less: plenty of people buy Pro for a home machine.

The passwords stolen from those managed machines were mostly personal accounts. google.com led with 1,316,590 stolen credentials, then facebook.com with 1,200,534. Roblox sits fourth at 704,262.

Then there’s microsoftonline.com, where Microsoft work and school accounts authenticate. 300,602 of those accounts turned up across 176,784 machines, roughly one in every seven we saw. About half sit on company domains, and another four in ten on school and university domains.

OpenAI credentials were on one machine in 14

That’s 89,571 infected machines, with 138,042 distinct OpenAI logins between them.

Don’t read the gap between OpenAI and the rest as a straight measure of who’s more exposed. A lot of people sign into AI tools with Google or Microsoft SSO, and an SSO login stores no separate password for the browser to leak. Those accounts are still reachable, just through the identity provider’s credential instead.

What makes a stolen AI login worth resetting is the conversation history behind it. People paste source code and customer records into these tools, and whoever holds the password can read all of it.

Stolen cookies and session hijacking

We captured 384,955,693 cookies from August’s logs. Most are analytics and tracking junk, so don’t read that total as 384 million hijackable sessions.

These are cookies for a sample of business services, not a ranking of risk. Any cookie that keeps someone signed in to your data deserves the same attention.

Changing a password doesn’t invalidate a session that’s already running. Revoking those sessions is a separate action that must be done when a session token is leaked.

Developer and collaboration accounts

Logins for developer tools and team chat turn up in the same logs.

GitHub credentials leaked from 90,774 separate machines. A stolen GitHub login is worth more than the account itself, because of what the account can reach: private repositories, and whatever secrets are sitting in the CI pipelines.

We can’t tell a person’s login from a service account in this data. Service accounts are the ones nobody rotates when an employee leaves.

What security teams should do

Scope the reset to the machine, not to the alert. August’s typical machine had 27 saved passwords, and the malware took all of them. If you reset just the account that fired the alert, you’ve left the other 26 exposed.

Revoke the session tokens too. 422,216 Microsoft login cookies leaked in August’s stealer logs. Each one is a session that a password reset on its own won’t close.

Set up Dark web monitoring alerts. Real-time alerts notify you when your employees’ credentials show up in infostealer logs or combo lists. Third-party breaches too.

Stolen credentials reach attackers by more than one route. Our August 2026 phishing report counts the ones taken from fake login pages, and the August 2026 ransomware report counts the companies named on leak sites that month.

Methodology

Every credential here was recovered from infostealer logs we index directly from private Telegram channels and criminal marketplaces. This isn’t a count of all infostealer activity for the month. Figures are dated by when we indexed the log, not when the machine was initially infected.

We count credential records, not unique credentials. The same username and password often turns up in several logs in one month, so August’s 133,005,847 records hold 57,979,449 distinct username and password pairs. The machine count is distinct within the month, but a machine infected across two months is counted in both.

22.3% of August’s credential rows carry no machine identifier. The per-machine figures in this report use the 103,292,422 rows that do.

Family attribution comes from the log itself. Some entries carry a seller’s Telegram handle in place of a family name. We’ve left those out of the family table.

The cookie total counts every cookie in the logs, including tracking and analytics cookies. We can’t tell an authentication cookie from a tracking one in this data, so the total isn’t a count of hijackable sessions.

Breachsense monitors the dark web and criminal marketplaces for your company’s exposed data, from leaked credentials to files stolen in ransomware attacks, and alerts your team by webhook or email when your data has surfaced.