Malware Statistics

Organisations are most comfortable authorising autonomous agents for threat intelligence enrichment and correlation (49%), phishing email quarantine or deletion (47%), and malware removal and system remediation (46%).

TsarBot targeted 450 banking apps and accounted for 58% of its global activity.

CopyBara targeted 446 banking apps.

Nexus concentrated 90% of its global targets in EMEA.

Firewalls are the most widely adopted measure (92%) among manufacturers, followed by malware protection (80%), secure configuration (67%) and access controls (61%).

Malware activity averaged 39,341 hits per firewall in the first half of 2026, giving financial services the second-highest per-device malware intensity of any industry, behind only healthcare.

Ten ransomware families were active against the financial services sector in the first half of 2026, including REvil (Sodinokibi) and Prometheus.

11% of the top 100 vendors most commonly used by universities currently show evidence of active infostealer malware infections.

IT and security professionals rate attackers using AI to generate self-mutating malware as a high or extreme risk at 55.9%, employees leaking sensitive data into public LLMs at 53.5%, AI-driven evasion techniques at 52.5%, and deepfakes or voice cloning used in fraud or BEC at 51.9%.

1 in 7 of Austrailian SME owners or managers reported malware.

33.9% of Australian SME owners or managers reported experiencing malware.

67.3% of the 832 malicious accounts banned between March 2025 and March 2026 used AI to write malware.

Across organizations in Europe, GitHub and Microsoft OneDrive are the most abused platforms for malware distribution, each impacting 10% of organizations.

56 malicious extensions were identified on OpenVSX.

495 malicious AI models were identified on Hugging Face.

969 malicious AI agent skills were identified carrying high-impact payloads.

The most prevalent malware families observed in 2025 are Cobalt Strike, Sliver, Metasploit, Burp, PlugX, SuperShell C2, Havoc, Panda C2, Brute Ratel, and ShadowPad.

Credential-stealer infections were dominated by RedLine with 911,968 infections (50.80%), Lumma with 499,784 infections (27.84%), and Vidar with 236,778 infections (13.19%).

The majority of businesses and charities have implemented basic technical controls, such as updated malware protection (81% businesses and 63% charities), backing up data securely via a cloud service (74% businesses and 57% charities), password policies (74% businesses and 56% charities), network firewalls (74% businesses and 45% charities) and restricted admin rights (73% businesses and 65% charities).

46% of IT security professionals report that AI is contributing to a rise in adaptive and evasive malware.

Over a quarter of CIOs report AI as a significant source of risk, placing it on par with malware, ransomware and phishing.

33% of CIOs identify malware and ransomware as dominant threats.

11.01% of organizations have active malicious packages embedded in production environments.

In 2025, more than 90% of open source vulnerability (OSV) malware advisories were reported, a 14x increase over the past two years.

BRICKSTORM achieved dwell times of nearly 400 days.

Enterprise workforces are three times more likely to be targeted with phishing attacks than with infostealer malware.

There is an average of 50 exposed user credentials per infostealer malware infection.

Malware hidden in public model and code repositories accounts for 35% of AI-related breaches.

Threat actors deployed more than 147,000 malicious domains, nearly 58,000 malware files, and actively exploited 549 vulnerabilities in 2025.

Over 11.1 million machines were infected with infostealers in 2025.

31% of Americans use anti-malware or antivirus software.

17% of adults aged 18–24 use anti-malware protection, versus 50% of adults aged 65 and older.

Across cloud providers, Azure draws 43.5% of observed malware samples, Google Cloud Platform draws 33.2%, and Amazon Web Services draws 23.2%.

Infostealer malware led to the exposure of over 300,000 ChatGPT credentials in 2025.

35% of SMB respondents say AI is creating adaptive and evasive malware.

BoaLoader malware is a factor in nearly 20% of incidents observed in the calendar year.

41% of internal audit leaders are concerned about the use of AI to insert malicious code.

In June 2025, BAUXITE deployed two custom wiper malware variants against Israeli targets.

12% of organizations detected employee exposure to malware via GitHub each month in 2025.

In 2025, malicious attachments were present in 18% of phishing attacks.