September 2026 Infostealer Trend Report

In September 2026, infostealer malware was predominantly distributed via SEO poisoning, masquerading as illegal software like cracks and keygens. Distribution platforms included Mediafire, AWS S3, Mega, and Cloudflare Storage. Executable files made up 90.8% of samples, with 9.2% using DLL side-loading techniques involving legitimate DLLs such as python37.dll and POWRPROF.dll. A new Rust-based infostealer named Lzveil was identified, which downloads configuration from command and control servers and employs modified Base64 decryption, XOR encryption, and LZNT1 compression. Email campaigns spread DarkCloud and AgentTesla infostealers, impersonating construction and logistics firms. These malware variants steal credentials, browser data, cryptocurrency wallets, and system information, with stolen data often sold on dark web markets or used in secondary attacks.

• August 2026 Infostealer Trend ReportMalware2026-09-22
• Case of AgentTesla Malware Distribution Disguised as a Business Proposal EmailMalware2026-10-14
• Warden Stealer: The Rapid Rise of an Infostealer with an Appetite for AI Agent DataMalware2026-10-09
• The Psychedelic Stealer: When the CAPTCHA Is the InstallerMalware2026-09-25
• $100k in Crypto Drained by the Underground OperationMalware2026-10-02