Infostealer Attacks in October 2026: Monthly Report
Quick Summary
October 2026’s stealer logs included 11,446 infected machines with a Microsoft 365 password and a device name. Two thirds of those machines had Windows’ default device name. If your company renames every machine it sets up, a default name points to a home PC or another machine IT didn’t set up. Require a compliant device for every Microsoft 365 sign-in.
Default Windows device names on infected Microsoft 365 machines
October’s stealer logs included 47,655 infected machines with a Microsoft 365 password saved. The logs recorded a device name for 11,446 of those machines. Of those, 7,593 had Windows’ default device name.
If your company renames every machine it sets up, an alert with a default name points to a machine IT didn’t set up.
Why listen to us?
Our founder, Josh Amishav, spent nearly 20 years as a penetration tester, getting into client networks with leaked credentials. He built Breachsense, a dark web monitoring API, to find leaked credentials before attackers use them. Our stealer-log alerts include the plaintext password. Kaspersky’s ICS CERT draws on our breach records in its quarterly reports on attacks against industrial companies. Other researchers and reporters cite our data too.
October 2026 infostealer numbers at a glance
- 326,444 infected machines in the logs we indexed
- 21 saved credentials leaked from the median machine
- 74,316,771 credential records, containing 29,983,953 distinct username and password pairs
- 47,655 machines had a Microsoft 365 password saved
- 29,175 machines had an OpenAI credential saved
Saved credentials per infected machine
The median infected machine leaked 21 saved credentials, up from 19 in September. A quarter of the machines leaked 65 saved credentials or more. One in ten machines leaked 142 saved credentials or more.
Have the employee change every password saved on the infected machine, starting with personal passwords they also use at work.
Infected machines had GitHub and OpenAI passwords saved
OpenAI credentials were on 29,175 infected machines, one machine in 11, up from one in 17 in September. GitHub credentials were on 26,021 infected machines.
| Platform | Distinct username and password pairs |
|---|---|
| openai.com | 95,462 |
| github.com | 89,642 |
| huggingface.co | 7,647 |
| docker.com | 3,542 |
| runwayml.com | 3,503 |
| gitlab.com | 2,648 |
| atlassian.net | 1,651 |
| npmjs.com | 982 |
A GitHub account an employee signed up for with a personal email address can be a member of your company’s GitHub organization. When you get a stealer-log alert for an employee, ask the employee for their GitHub username and check whether that account is a member of your GitHub organization. If it is, have the employee sign out of every GitHub session and revoke the account’s personal access tokens.
What security teams should do
Find the infected machine. Breachsense alerts include the device name when the stealer log records it. Check the name against your naming standard and device inventory. If the stealer log contains them, the alert also includes the machine’s IP address and hardware ID. The IP address shows which network the machine was on. The hardware ID tells you whether two alerts came from the same machine. If the alert doesn’t identify the machine, check the account’s sign-in logs in Microsoft Entra. Each sign-in shows whether the device was managed or compliant.
If the machine is yours, reimage it. Reset the password and revoke the user’s sessions first.
If the machine isn’t yours, require a compliant device for Microsoft 365 sign-ins. You can’t clean a machine you don’t manage, so reset the password and revoke the user’s sessions. Then turn on a Microsoft Entra Conditional Access policy that requires the device to be marked as compliant in Intune. Apply the policy to all users, so it also blocks Microsoft 365 sign-ins from unmanaged machines you haven’t found yet.
How we collected this data
We count each stealer log in the month we indexed it.
We count a device name as a Windows default when it’s DESKTOP- or LAPTOP- followed by seven or eight random characters.
We count a credential as Microsoft 365 when it’s saved for microsoftonline.com, Microsoft’s sign-in domain.
Get an alert when an employee’s password turns up in a stealer log
With infostealer detection, we send you a webhook or email alert when we find one of your employees’ passwords in a stealer log.
Breachsense is a dark web monitoring API for security teams and MSSPs. It finds credentials and session tokens that have already been stolen from your staff or customers, whether by infostealer malware or a phishing page. It sends those credentials and tokens by webhook, so teams can reset the affected accounts before attackers use them. It also indexes the files ransomware groups leak, so you can search them for your own company’s data.
To see which of your employees’ credentials have already leaked, run a free dark web scan. To get an alert when your staff’s credentials show up in a new stealer log, book a demo.
Our October 2026 phishing report counts credentials taken from fake login pages. The October 2026 ransomware report counts the companies named on leak sites. For the previous month’s infostealer numbers, see the September 2026 infostealer report.