The malware ranking reflects total sample uploads to a public malware analysis sandbox and captures the tools that red teams, SOC analysts, and threat hunters are most frequently encountering in the wild.
Info-stealers (Vidar, Stealc, Lumma) and Remote Access Trojans/RATs (AsyncRAT, XWorm, Remcos, Quasar) dominate the list, reflecting the continued commoditization of Malware-as-a-Service (MaaS) offerings sold on underground forums.
Vidar led the charts with 235 total uploads despite a weekly decline of 47 samples, while AsyncRAT followed closely at 214 uploads (down 60), and XWorm posted 205 uploads with a rare weekly increase of 13 samples, signaling renewed campaign activity.
| Rank | Malware Family | Type | Total Uploads | Weekly Change |
|---|---|---|---|---|
| 1 | Vidar | Infostealer | 235 | -47 |
| 2 | AsyncRAT | RAT | 214 | -60 |
| 3 | XWorm | RAT | 205 | +13 |
| 4 | Remcos | RAT/Surveillanceware | 158 | -36 |
| 5 | Stealc | Infostealer | 126 | -44 |
| 6 | Lumma | Infostealer | 121 | -21 |
| 7 | Formbook | Infostealer | 113 | +41 |
| 8 | Quasar | RAT | 109 | -6 |
| 9 | AgentTesla | Infostealer/Keylogger | 108 | -59 |
| 10 | DonutLoader | Loader | 99 | -58 |
Formbook and XWorm were the only families to trend upward for the week, an important signal for defenders since rising upload counts often precede a spike in active campaigns targeting new lures or vulnerabilities.
AgentTesla and DonutLoader saw the steepest declines, dropping 59 and 58 samples respectively, though both remain firmly embedded in commodity phishing kits.
Threat Family Profiles
Vidar Stealer
Vidar is a forked, Arkei-based information stealer operating as malware-as-a-service that harvests browser credentials, cookies, two-factor authentication data, Tor Browser configurations, and cryptocurrency wallets.
Recent 2026 campaigns show Vidar delivered through malvertising leading to fake cracked-software downloads, and via trojanized GitHub repositories disguised as legitimate developer tools, with payloads embedded in JPEG and TXT files for in-memory execution.
A parallel campaign combines Vidar with the XMRig cryptominer using DLL sideloading via a Go-compiled fake MpClient.dll for evasion.
AsyncRAT
AsyncRAT is a widely abused open-source Remote Access Trojan that provides remote command execution, data exfiltration, and covert surveillance of Windows systems.
Current campaigns abuse legitimate infrastructure such as Dropbox links and TryCloudflare tunnels, employing a multi-stage chain starting with an LNK file, followed by JS and BAT scripts that ultimately deploy Python-based loaders while displaying a decoy invoice PDF.
Persistence is established through startup-folder batch scripts and code injection into explorer.exe, and one regional campaign observed C2 traffic on TCP ports 6606, 7707, and 8808.
XWorm
XWorm is a modular RAT sold through malware-as-a-service channels since 2022, offering credential theft, keylogging, webcam access, DDoS, and ransomware-deployment plugins.
The 2026 infection chain begins with phishing emails containing ZIP attachments (e.g., disguised as payment confirmations), extracting a malicious JavaScript loader that establishes Startup persistence and retrieves a Base64-encoded DLL appended to a JPEG hosted on public image services.
The payload is injected into MSBuild.exe or Aspnet_compiler.exe via process hollowing for fileless execution, and newer variants exploit the WinRAR flaw CVE-2025-8088 and CVE-2018-0802 in Excel to bypass detection.
Remcos RAT
Remcos began as a legitimate remote administration tool but is now abused as a surveillance-as-a-service RAT capable of live webcam streaming, instant keylogging, credential theft, and screen capture.
Phishing emails with malicious ZIP/LNK attachments remain the primary vector, followed by text-based staging and abuse of legitimate Microsoft LOLBins such as MSBuild.exe to evade detection.
Education, professional services, and finance sectors in Latin America (Colombia, Brazil) and the U.S. are the most targeted, with C2 traffic frequently routed through Dynamic DNS providers like DuckDNS.
Stealc
Stealc is a modular, malware-as-a-service infostealer targeting browsers, FTP clients, messaging apps, email clients, gaming platforms, and cryptocurrency wallets, and its V2 iteration added RC4 encryption for stolen data.
It spreads through phishing attachments, malvertising, drive-by downloads, and cracked software/keygen sites, and is frequently bundled in cybercrime service chains alongside Amadey.
Lumma Stealer
Lumma (LummaC2) is a subscription-based MaaS infostealer that resurfaced with stealthier tactics after a law-enforcement takedown of its core infrastructure.
Current delivery methods include fake CAPTCHA “ClickFix” pages that trick victims into executing malicious PowerShell via the Windows Run dialog, trojanized GitHub repositories with AI-generated README files promoting game cheats, and coordinated YouTube video campaigns linking to malicious downloads.
Formbook
Formbook is a long-running data stealer and form-grabber sold as MaaS since 2016, capable of keylogging, screenshot capture, credential theft, and staging additional malware.
Recent campaigns use phishing emails with RAR attachments abusing DLL sideloading, or obfuscated JavaScript embedded in PDFs, while older waves exploited CVE-2017-11882 in Microsoft Equation Editor via malicious Word documents. Aerospace, defense contractors, and manufacturing sectors in the U.S. and South Korea have been disproportionately targeted.
Quasar RAT
Quasar is an open-source, C#-based RAT that grants attackers full remote control, including registry editing, keylogging, password theft, and file exfiltration.
It is commonly delivered via malicious RTF/Office documents that trigger PowerShell payload downloads, and newer variants use dual DLL sideloading to drop and execute payloads without triggering standard detections.
AgentTesla
AgentTesla is a .NET-based RAT and advanced keylogger active since 2014, capable of clipboard logging, screen capture, and stealing stored browser and email credentials.
It is chiefly delivered through phishing emails exploiting Microsoft Office vulnerabilities CVE-2017-11882 and CVE-2017-8570, with data typically exfiltrated via SMTP, FTP, or Telegram bot channels.
DonutLoader
DonutLoader is a shellcode-based loader leveraging the “Donut” fileless execution framework to deploy secondary payloads such as PureLogs stealer in-memory, avoiding disk-based artifacts.
Recent campaigns use ClickFix-style spoofed licensing websites that trick victims into running malicious PowerShell commands, establishing TCP-based C2 for data exfiltration and configuration retrieval.
Known Infection Vectors
Phishing remains the dominant common denominator across all ten families, but the specific lure and payload staging techniques vary significantly by malware family.
| Infection Vector | Malware Families Using It |
|---|---|
| Phishing email with ZIP/RAR archive attachment | AsyncRAT, XWorm, Remcos, Formbook |
| Malicious Office document (macro/exploit) | AgentTesla, Quasar, Formbook, Snake Keylogger |
| Malvertising / fake cracked software | Vidar, Stealc, Lumma |
| Trojanized GitHub repositories | Vidar, Lumma |
| Fake CAPTCHA / ClickFix PowerShell execution | Lumma, DonutLoader |
| LNK/JS/BAT multi-stage script chains | AsyncRAT, XWorm |
| PDF or image (JPEG) steganographic payloads | XWorm, Vidar |
| Dropbox/TryCloudflare abused infrastructure | AsyncRAT |
Known Tools and Living-off-the-Land Binaries Abused
Threat actors increasingly favor legitimate, signed Windows utilities (LOLBins) to blend malicious activity into normal system noise and defeat signature-based detection.
- MSBuild.exe abused by XWorm and Remcos for reflective DLL injection and payload execution
- Aspnet_compiler.exe used by XWorm for in-memory reflective DLL injection
- PowerShell (-nop, -ep bypass) used across XWorm, DonutLoader, and Lumma ClickFix chains for staged payload decryption and execution
- wscript.exe / mshta.exe used to trigger JavaScript and HTA loaders in XWorm and Remcos campaigns
- RegAsm.exe / RegSvcs.exe / InstallUtil.exe abused via process hollowing/injection by AgentTesla and Snake Keylogger
- explorer.exe target of code injection in AsyncRAT campaigns
- Python interpreter (legitimate installer) deployed by AsyncRAT operators to run malicious scripts under a trusted runtime
- Donut shellcode framework used by DonutLoader for fileless in-memory .NET assembly loading
Targeted Industries
Common Vulnerabilities Exploited (CVEs)
Beyond these documented CVEs, most families rely on social engineering and legitimate-tool abuse rather than novel zero-days, underscoring that patch management alone is insufficient — user-behavior controls and macro/script restrictions are equally critical.
Indicators of Compromise (IOCs)
File Hashes
Malicious Domains and URLs
IP Addresses
Network Ports and Exfiltration Channels
Defensive Recommendations for Cyber Defenders
Given that phishing and living-off-the-land technique abuse dominate this week’s top malware, defenders should prioritize layered controls over any single detection mechanism.
- Enforce email attachment filtering that blocks or sandboxes ZIP, RAR, ISO, LNK, and JS/VBS/HTA attachments by default
- Patch Microsoft Office and WinRAR immediately to close CVE-2017-11882, CVE-2017-8570, CVE-2018-0802, and CVE-2025-8088
- Monitor for anomalous process lineages such as PowerShell spawning MSBuild.exe, Aspnet_compiler.exe, or RegAsm.exe, which indicate reflective DLL injection or process hollowing
- Deploy DNS monitoring for Dynamic DNS providers (DuckDNS, ydns.eu, dns.army) and TryCloudflare tunnel subdomains frequently abused as C2 infrastructure
- Restrict execution of scripts from %APPDATA%, %TEMP%, and Startup folders via Software Restriction Policies or AppLocker
- Block outbound Telegram Bot API traffic where not business-justified, since multiple families exfiltrate data via Telegram channels
- Enforce MFA universally to blunt the impact of credential theft from infostealers like Vidar, Stealc, and Lumma
- Disable Office macros by default and restrict VBScript execution through Group Policy
