A takedown makes headlines once. What happens afterwards rarely does.
On 29 October 2024, Dutch and United States authorities announced Operation Magnus, an action against the RedLine and Meta infostealers. Two domains and three command and control servers were seized, Telegram channels were taken offline, and Eurojust reported that millions of compromised credentials were recovered. Two people were arrested in Belgium, one of whom was later released, and charges were unsealed in the United States against an alleged administrator.
Twelve months later, in Albania, RedLine accounted for 52.4 percent of the infostealer detections our pipeline could label. Six months after that, in April 2026, it accounted for 87.8 percent. It rose in every intervening month without exception.
Six months of Albanian detections
The figures below cover November 2025 to April 2026, a window of 9,819 systems. Of those, 3,113 carried no family label, and the percentages are calculated against the 6,739 records that did.
November 2025. 1,511 systems, 805 labelled. RedLine 422, which is 52.4 percent. Meta 204, which is 25.3 percent.
December 2025. 1,179 systems, 744 labelled. RedLine 443, 59.5 percent. Meta 163, 21.9 percent.
January 2026. 1,775 systems, 1,209 labelled. RedLine 829, 68.6 percent. Meta 307, 25.4 percent.
February 2026. 2,952 systems, 2,199 labelled. RedLine 1,743, 79.3 percent. Meta 386, 17.6 percent. This is the highest volume month in the window.
March 2026. 1,574 systems, 1,149 labelled. RedLine 919, 80.0 percent. Meta 198, 17.2 percent.
April 2026. 828 systems, 633 labelled. RedLine 556, 87.8 percent. Meta 68, 10.7 percent.
Across the whole window RedLine is 4,912 records, 72.9 percent of everything labelled. Meta is 1,326, or 19.7 percent. The remaining 7.4 percent is divided between LummaC2 at 185 records, Vidar at 168, StealC at 143, and two others in single figures.
The pair matters more than either family
Magnus targeted RedLine and Meta in one action, so the honest unit of measurement is the pair.
In November 2025 the two families together were 77.8 percent of labelled Albanian detections. By April 2026 they were 98.6 percent. Almost everything our pipeline could put a name to in Albania that month came from one of the two families that had been taken down eighteen months earlier.
Meta's own share fell over the window, from 25.3 percent to 10.7 percent. That decline is real, but it is a decline relative to RedLine rather than a disappearance, and it is swamped by RedLine's growth.
This is not a global claim
Our visibility is one country. The global picture has been measured properly by others, and it points the same way.
Flare Research analysed roughly 44 million stealer logs collected between June 2024 and June 2026 and published its findings on 25 September 2026. It reports that RedLine volume tripled in the 90 days following Operation Magnus, and concludes that most infostealer takedowns do not reduce activity over the long term, with the May 2025 action against LummaC2 standing out as the exception, where volume fell 46 percent in the two weeks afterwards and stayed 39 percent below baseline over the following 90 days.
Intel 471, writing the day after Magnus was announced, noted that RedLine activity had only slightly decreased, and attributed that to the code and administration panel circulating through vendors outside the targeted operation, and to cracked copies that bypass licensing.
Our contribution is narrow and national: a country-level series, month by month, showing the same direction of travel.
Why the window stops in April
Our Albanian detection volume changes sharply after April 2026, falling from 828 systems in that month to 86 by July. We have not established the cause, and until we do we cannot say whether later months are comparable with earlier ones.
Rather than extend the series and quietly carry that problem into the findings, we have stopped the window where the volume is stable and said why. A six month series we can stand behind is worth more than a twelve month one we cannot.
What to take from this
A takedown headline is not an all clear. The families named in an enforcement action can keep producing credentials for years afterwards. Removing them from a monitoring list because they were seized is a decision made on news coverage rather than on data.
Infrastructure seizure and code distribution are different problems. Magnus took servers and domains. It did not take every copy of the builder, and a family whose code circulates independently does not need its original operators.
Concentration cuts both ways. If two families account for most of what reaches a country, detection for those two families covers most of the exposure. That is a useful property, as long as the list is reviewed against data rather than assumptions.
Old credentials keep arriving. A credential taken by a RedLine build in 2025 is still a working credential in 2026 if nobody has rotated it. The age of the malware says nothing about the freshness of the risk.
Method and limitations
Detections are drawn from SphereTI's monitoring infrastructure, which ingests infostealer output distributed through criminal marketplaces, messaging channels and forums. A record counts as unique if the leaked data is unique or the breach date is unique.
Records are not people, machines or organisations. We claim no mapping from records to compromised hosts, individuals or organisations, and none can be derived from these figures.
Country is assigned by victim IP geolocation. Albania here means the address of the infected machine resolved to Albania. It does not mean an Albanian organisation. Travellers, VPN exits and mobile ranges fall into the same bucket.
Kosovo cannot be separated and may be partly inside these numbers. Kosovar ISP ranges resolve variously to Serbia and to Albania, so no clean Kosovo figure exists and some Kosovar machines may sit in the Albanian count.
Roughly a third of records carry no family label. Across the window 3,113 of 9,819 systems, 31.7 percent, are unlabelled. All percentages in this article are shares of the 6,739 that are labelled, not of everything collected.
The dashboard reports the six most common families. Anything below sixth place in a given month is not visible to us, so a family reading as absent may simply have fallen outside the top six.
One month does not reconcile. In November 2025 the family counts sum to 805 while total systems minus unlabelled gives 769. The 36 record difference suggests a record can carry more than one family label. Other months in the window reconcile within two records. We report the November figure as it stands.
Family labels are partly inherited. Attribution comes from the source's own labelling combined with our fingerprinting, so part of it originates with the sellers distributing the data.
Six months is a short series. It shows a direction within this window. It does not establish a long term trend, and it covers one country.
Disclosure
SphereTI sells credential exposure monitoring. The data in this article comes from the same infrastructure that service runs on.
Check your own exposure
SphereTI monitors credential exposure across breach data, infostealer logs,credential lists and third party data breaches, and reports which of your domains appear, where the credential came from and when it surfaced. Request a free exposure report. No password is needed, and the questions above apply to us too.