The Scale of the Threat: 11.1 Million Devices and 3.3 Billion Credentials

The Scale of the Threat: 11.1 Million Devices and 3.3 Billion Credentials

This lesson sets the stage. You’ll learn what infostealers are, why they have become the dominant malware type, and the jaw-dropping scale of the problem. By the end, you’ll understand why infostealers are the modern key to digital kingdoms and how they have changed the threat landscape forever.

What Exactly Is an Infostealer?

Imagine waking up one morning to find that someone is logged into your email, your bank, your social media, and your work accounts—all at the same time. You haven’t shared your passwords. You haven’t clicked on anything suspicious. Yet somehow, someone is in. How did this happen?

This scenario illustrates a common access-theft pattern. The initial compromise may be automated rather than a person manually breaking into each account. One important cause is an infostealer: malware designed to collect credentials, browser data, and other information that can enable later account abuse.

What exactly is an infostealer?

An infostealer is a type of malicious software designed to quietly extract valuable information from an infected device and send it to an attacker. Unlike ransomware, which announces its presence with a demand for payment, infostealers operate in silence. They are the silent burglars of the digital age.

These malware families are designed to steal:

• Browser credentials: usernames and passwords stored in web browsers
• Cookies and session tokens: the keys that keep you logged into websites
• Cryptocurrency wallets: private keys and wallet data
• Files and documents: anything valuable on your device
• System information: device fingerprints, IP addresses, and software versions
• Credit card information: stored payment details

Why infostealers have become the dominant threat

Think about the shift in the cybercriminal economy. Ten years ago, attackers focused on ransomware because it generated direct revenue through ransoms. But ransomware has become noisy, traceable, and increasingly difficult to profit from.

Infostealers changed the game. Instead of demanding a ransom, attackers steal credentials and sell them on underground markets. One infected device can yield dozens of credentials, each of which can be sold for anywhere from a few dollars to hundreds of dollars depending on the value of the account. A single infostealer infection can generate hundreds or thousands of dollars in stolen data—with almost no risk.

Here is what the numbers tell us about the scale of this threat.

2025 statistics:

• Over 11.1 million devices infected with infostealers
• More than 3.3 billion credentials stolen
• These numbers represent a dramatic increase year-over-year

2026 early data:

• One infostealer family alone—Vidar—accounted for over 73% of all infections
• The infostealer-as-a-service model has made these tools accessible to anyone with a few dollars
• Telegram has emerged as the primary channel for data exfiltration

Let me put these numbers in perspective. 11.1 million infected devices means that for every 500 people in your organization, statistically one is likely infected. 3.3 billion stolen credentials means that your password—or a password you used years ago—is almost certainly sitting on an underground market right now.

The journey we are about to take

Over the next modules, we will walk through the entire lifecycle of an infostealer infection. You will learn:

1. How infostealers infect devices—the delivery methods that are succeeding
2. How they operate internally—what happens after infection
3. What they steal—and why some data is more valuable than others
4. How data is exfiltrated—including the surprisingly common use of Telegram bots
5. Where stolen data goes—the underground economy and how your credentials are traded
6. How to defend—practical strategies to protect yourself and your organization

This is not abstract theory. These are practical insights based on the current threat landscape. By the end of this course, you will understand infostealers better than 99% of security professionals, and you will know exactly what steps to take to reduce your risk.

Let us begin.

The Numbers That Matter

Let us pause for a moment and let the numbers sink in. 11.1 million infected devices. 3.3 billion stolen credentials. These are not abstract figures—they represent real people, real organizations, and real consequences.

What do these numbers actually mean?

11.1 million infected devices means that infostealers are active on machines across every industry, every country, and every type of organization. No sector is immune. Financial services, healthcare, government, education, manufacturing, retail—all are represented in these numbers. The attackers do not discriminate. They target anyone who has something of value.

3.3 billion stolen credentials means that the average person has multiple compromised accounts. If you have been using the internet for more than a few years, there is a high probability that at least one of your passwords has been stolen. The question is not whether your credentials have been exposed—it is whether they have been used yet.

The Vidar dominance: 73% of infections

In early 2026, security researchers observed something remarkable. One infostealer family—Vidar—accounted for over 73% of all infostealer infections. This is not because Vidar is the only infostealer. There are dozens of families, including RedLine, Raccoon Stealer, and others. But Vidar has emerged as the dominant player in the market.

Why Vidar? The answer is simple: effectiveness and accessibility. Vidar is offered as a service—infostealer-as-a-service. Anyone with a few hundred dollars can rent access to Vidar’s infrastructure and start infecting devices. The malware is constantly updated, detection evasion techniques are improved regularly, and the support is professional. This has lowered the barrier to entry so dramatically that virtually anyone can become a credential thief.

The connection to Telegram

One of the most striking developments in the infostealer ecosystem is the role of Telegram. In 2025 and 2026, Telegram emerged as the primary channel for data exfiltration. Attackers configure their infostealers to send stolen data directly to a Telegram bot. The bot receives the data, and the attacker receives a notification on their phone or computer.

Why Telegram? It is fast, free, anonymous, and easy to automate. The Telegram API allows attackers to create bots that receive and store stolen data without any infrastructure costs. Telegram has become the courier of the cybercriminal world.

The threat is not going away

These numbers are not declining. They are accelerating. The infostealer ecosystem is becoming more sophisticated, more accessible, and more damaging every year. Understanding this threat is no longer optional—it is essential for anyone who uses technology, whether personally or professionally.

In the next module, we will look inside the infostealer itself. You will learn how these malware families work, how they infect devices, and what they do once they are inside. But first, let us answer one of the most common questions students ask at this point: “Is my data already stolen?”

The honest answer is: it is very likely. The question is whether it has been used yet. And that is where our journey continues—by understanding exactly what attackers do with stolen credentials.