A Data-Driven Analysis of Infostealer Malware Victims

Infostealer malware infects devices globally and collects the most sensitive data at scale: credentials, browser sessions, private keys, and access certificates. Yet its impact on victims remains difficult to study without an ethical, legal, and curated research dataset. To close this gap, we build a privacy-preserving pipeline that turns illicitly sourced infostealer logs into a reproducible research artifact, minimizing sensitive data while preserving measurement utility, and use it to construct a dataset of 170,298 hosts across seven infostealer families. Analyzing these victims, we find that the most compromised services mirror the world’s most popular platforms, with gaming and entertainment services strongly overrepresented. Within the sample we identify compromised credentials for high-value organizations, including law-enforcement domains, government and military services, and all eight Ivy League universities, alongside substantial exposure to critical security and infrastructure-level services and to financial, remote-access, and development platforms. Victims also show widespread credential reuse and significant revictimization risk, overlapping with phishing and ransomware victim populations. We release the anonymized dataset to enable ethical, privacy-preserving, and reproducible research on information security and victim behavior.See the article:Arttu Paju, Juha Nurmi, David Arroyo, Sergio Chica Manjarrez, Fran Casino, Mikko Niemelä, Juuso Itkonen, Joel Scanlan, Constantinos Patsakis, Georgios Smaragdakis, A data-driven analysis of infostealer malware victims, Computers & Security, 2026, 105176, ISSN 0167-4048,https://doi.org/10.1016/j.cose.2026.105176Keywords: Information stealer; Malware-as-a-service; Credential theft; Web security; Cybercrime measurement; Data anonymization; User behavior