September 2026 Infostealer Trend Report

This Infostealer Trend Report summarizes the distribution channels, number of malware samples, number of detections, and information on companies targeted by new Infostealers (malware designed to steal information) collected during the month of September 2026. The data was compiled based on detection logs from AhnLab SEcurity intelligence Center (ASEC) and AhnLab products, and includes samples collected by Automated Data Collection Systems and Email Honeypot systems.

This report was prepared to examine trends in the overall quantity of infostealers, their disguise techniques, and distribution methods. Major Issues and analysis information not specifically mentioned here can be found on AhnLab TIP (Threat Intelligence Platform, hereinafter ATIP).

Infostealers disguised as illegal programs, such as “Crack” and “Keygen,” were distributed through SEO poisoning. Major distribution sites identified included Mediafire.Com, amazonaws.S3.Us-east-1.Amazonaws.Com, mega.Nz, and cloudflarestorage.Com. Companies targeted for impersonation included Brospint Studio, Aurora Wave Labs, Microsoft Corporation, and the Python Software Foundation.

EXE files accounted for the majority at approximately 90.8%, While DLL side-loading (a technique that places a legitimate EXE alongside a malicious DLL to ensure the malicious DLL is loaded) accounted for 9.2%. The primary DLLs used in DLL side-loading included python37.Dll, python36.Dll, POWRPROF.Dll, and jli.Dll.

The new infostealer, Lzveil, is built using Rust and operates by downloading configuration data from a C2 server. Strings are decrypted using a modified Base64 algorithm, and C2 communications employ both XOR encryption and LZNT1 compression. Upon execution, it sends a list of installed programs, the CPU name, driver information, and other data to the C2 server; depending on the response, the installation of additional malware may be triggered.

In terms of email distribution, the DarkCloud infostealer was included in an email impersonating a Qatari construction company, while the AgentTesla infostealer was included in an email impersonating a well-known logistics company. DarkCloud steals document files, keylogging data, email client information, browser information, screenshots, and cryptocurrency wallet information, while AgentTesla can transmit stolen data via FTP, Telegram, SMTP, and other channels.

Infostealer threat groups are actively spreading their malware through various paths—such as files disguised as cracked software, posts on legitimate websites, and emails—targeting both businesses and individual users. Since the stolen information can be traded on the dark web or used for secondary attacks, it is essential to be cautious of untrusted links and Attachments, avoid using illegal software, enable two-factor authentication (2FA), and keep security software up to date.