Credential-stealer infections were dominated by RedLine with 911,968 infections (50.80%), Lumma with 499,784 infections (27.84%), and Vidar with 236,778 infections (13.19%).

Publisher	Fortinet
Report	2026 Global Threat Landscape Report
Published	30 April 2026
Topics	Malware, Credential Theft, Infostealer

Published by Fortinet in 2026 Global Threat Landscape Report, 30 April 2026. The figure is taken from the report as published; the full methodology is in the source.

View the original report

Related statistics

Malware activity averaged 39,341 hits per firewall in the first half of 2026, giving financial services the second-highest per-device malware intensity of any industry, behind only healthcare.

SonicWall, 12/07/2026

Ten ransomware families were active against the financial services sector in the first half of 2026, including REvil (Sodinokibi) and Prometheus.

SonicWall, 12/07/2026

11% of the top 100 vendors most commonly used by universities currently show evidence of active infostealer malware infections.

UpGuard, 04/07/2026

IT and security professionals rate attackers using AI to generate self-mutating malware as a high or extreme risk at 55.9%, employees leaking sensitive data into public LLMs at 53.5%, AI-driven evasion techniques at 52.5%, and deepfakes or voice cloning used in fraud or BEC at 51.9%.

Bitdefender, 04/07/2026

33.9% of Australian SME owners or managers reported experiencing malware.

Australian Institute of Criminology, 04/07/2026

1 in 7 of Austrailian SME owners or managers reported malware.

Australian Institute of Criminology, 04/07/2026

Get the newsletter

Weekly cybersecurity statistics by email.