Constella says infostealer infections nearly doubled in Q2 2026

Constella Intelligence’s latest quarterly report says infostealer infections surged in Q2 2026, exposing millions of devices and billions of records tied to usernames, passwords, and online services. The company says the growth shows identity risk is extending beyond corporate systems and into personal and unmanaged devices.

Why it matters: - Infostealer malware can reveal credentials, browser activity, device details and the services a victim uses. - That data gives criminals more context for targeted fraud, phishing, impersonation and other personalized scams. - The findings suggest identity exposure now extends well beyond traditional corporate security controls.

What happened: - Constella Intelligence released its Quarterly Identity Breach Report covering Q2 2026. - The report says 5.53 million devices were registered with Q2 infostealer infection dates, up 99.53% from Q1. - Constella also identified more than 670,000 potential breaches containing more than 447 billion records during the quarter. - After verification, deduplication and quality review, more than 4,000 breaches containing 10.82 billion records and 57.64 billion attributes were ingested into the Constella Data Lake.

The details: - Nearly every Q2 infostealer record analyzed contained a URL linked to an online service accessed from the infected device. - 94.97% of Q2 infostealer records contained passwords. - 46.95% contained usernames. - 46.05% contained email addresses. - Constella’s Data Lake ended the quarter with 72.95 billion records, up 14.07% from Q1, and 544.16 billion attributes. - Email addresses appeared in 51.07% of curated Hacked Leaked and Combo records, up 11.19 percentage points from Q1. - Plaintext passwords appeared in 50.90% of curated Hacked Leaked and Combo records. - More than 95% of Q2 Hacked Leaked breaches contained personally identifiable information beyond credentials. - That added data included names, phone numbers, addresses, identifiers and financial information. - The report says browser cookies and session tokens captured by infostealers can let an attacker reuse an already authenticated session if the session remains valid. - The actual risk depends on token validity, platform controls and whether compromised sessions are detected and revoked. - Constella observed 64.72 million social media attributes across six tracked platforms. - Telegram and Facebook accounted for 95.81% of that exposure. - The five largest verified Q2 breaches tied to specific companies or domains contained a combined 1.05 billion records.

Between the lines: - The report points to a shift from simple credential theft to broader identity exposure. - That matters because exposed context can help attackers prioritize which accounts to target and make scams harder to spot. - Constella CEO Andres Andreu said organizations cannot protect what they cannot see and that identity risk management must extend beyond internal systems. - The report also underscores a gap between password resets and the larger problem of exposed identity data already circulating among adversaries.

What's next: - Constella recommends expanding identity risk management beyond internal systems. - The company advises organizations to correlate external exposure across identities, treat confirmed plaintext credentials as immediately actionable, investigate infostealer infections beyond password resets, strengthen authentication controls and continuously monitor external identity exposure. - Constella says its full quarterly report includes analysis of breach and infostealer intelligence, geographic and industry concentration and recommended actions for security teams. - The company also said CEO Andres Andreu and CTO Alberto Casares discuss the infostealer landscape and what the exposures mean for protecting employees, customers and digital identities.

The bottom line: - The report frames infostealers as an identity-risk problem, not just a malware problem, because the stolen data can power more precise attacks across personal and workplace accounts.