Original title: A data-driven analysis of infostealer malware victims
Arttu Paju, Juha Nurmi, David Arroyo, Sergio Chica +6 · September 2026
Infostealer malwareMalware that secretly steals information from infected devices, like passwords and certificates. infects computers and steals highly sensitive data, such as passwords, browser sessions, private keys, and certificates. Studying this threat is tough because using stolen data raises legal and privacy concerns. To solve this, researchers built a pipeline that strips out sensitive personal details from hacker logs while keeping the data useful for study. They analyzed logs from multiple malware strains to see who gets hit. They found that stolen accounts mostly match the world's most popular online platforms, especially gaming and entertainment sites. Worse, the stolen files contained logins for high-value targets, including law enforcement, military and government branches, and all eight Ivy League universities. Many victims reused passwords, and many faced repeated cyberattacks.
You keep all your house keys on a single keychain. One day, a thief steals the entire keychain, copies every key, and returns the originals without you noticing. Now the thief and others have access to your home, car, and office. In this paper, the researchers found a pile of these copied keys, but first they blurred out the addresses on the key tags before studying which types of keys were stolen most often. They discovered that the same key is often used for multiple locks, and that some keys were from police stations and university buildings.
For individuals, this means stolen passwords are reused across multiple services, so one leak can compromise many accounts. For organizations, it shows that even high-security targets like government and military domains are breached, and that victims of phishing and ransomware often share the same stolen credentials, amplifying the damage.
The abstract does not state explicit limitations, but the dataset is derived from specific illicit logs and may not represent all infostealer victims. The privacy-preserving pipeline necessarily discards some sensitive data, potentially limiting the depth of analysis. The findings on credential reuse and revictimization are based on observed patterns, but causal links remain unclear. Additionally, the dataset release is under controlled access, which may limit reproducibility.
Ask anything about this paper. Answers come from its abstract, and say so when the abstract doesn't cover your question.
A data-driven analysis of infostealer malware victims — Arttu Paju, Juha Nurmi, David Arroyo et al. — Computers & Security — doi:10.1016/j.cose.2026.105176
Abstract licence: CC BY
Explanation generated by Synthesis from the abstract — it is not the original paper.