Top 10 Malware Threats Observed July 20-26, 2026

Key Takeaways

• Information stealers and Remote Access Trojans (RATs) continue to dominate the threat landscape, driven by accessible Malware-as-a-Service (MaaS) offerings.
• Vidar, AsyncRAT, and XWorm were the most frequently observed malware families, with XWorm and Formbook showing increased activity.
• Phishing remains the primary infection vector, often leveraging legitimate infrastructure and “living off the land” binaries (LOLBins) to bypass traditional defenses.
• Key vulnerabilities exploited include CVE-2017-11882 in Microsoft Equation Editor and CVE-2025-8088 in WinRAR.
• Organizations must implement layered security, including robust email filtering, patch management, process monitoring, and user behavior controls, to mitigate these pervasive threats.

Overview of Malware Trends: July 20-26, 2026

The latest analysis of malware submissions to public sandboxes reveals a consistent pattern in the tools most frequently encountered by cybersecurity professionals. This week’s data, spanning July 20-26, 2026, highlights the persistent threat posed by information stealers and Remote Access Trojans (RATs), underscoring the widespread availability and utility of Malware-as-a-Service (MaaS) offerings in the cybercriminal underground.

Info-stealers such as Vidar, Stealc, and Lumma, alongside RATs like AsyncRAT, XWorm, Remcos, and Quasar, constitute the majority of observed threats. This dominance reflects a market where sophisticated malicious capabilities are readily accessible, enabling a broad range of cyberattacks.

Vidar led the weekly rankings with 235 total uploads, despite a decrease of 47 samples from the previous period. AsyncRAT was a close second, registering 214 uploads, a reduction of 60. Conversely, XWorm saw a notable uptick with 205 uploads, marking a rare weekly increase of 13 samples, which suggests renewed or expanded campaign activity.

Formbook and XWorm were the only malware families to exhibit an upward trend in upload counts this week. This rise is a critical indicator for defenders, as increasing submission rates often precede a surge in active campaigns exploiting new vulnerabilities or employing novel lures.

In contrast, AgentTesla and DonutLoader experienced the most significant declines, with 59 and 58 fewer samples, respectively. Despite these drops, both families remain prevalent components of commodity phishing kits, indicating their continued use in initial access operations.

Top 10 Malware Families by Uploads (July 20-26, 2026)

Threat Family Profiles

Vidar Stealer

Vidar, an information stealer derived from Arkei, operates as a malware-as-a-service (MaaS) offering. Its primary function is to harvest sensitive data, including browser credentials, cookies, two-factor authentication information, Tor Browser configurations, and cryptocurrency wallet details. Recent campaigns in 2026 have seen Vidar distributed through malvertising, leading to fake cracked-software downloads, and via trojanized GitHub repositories masquerading as legitimate developer tools. The payloads are often cleverly embedded within JPEG and TXT files for in-memory execution. A notable parallel campaign involves Vidar being delivered alongside the XMRig cryptominer, employing DLL sideloading through a Go-compiled fake MpClient.dll to evade detection.

AsyncRAT

AsyncRAT is a widely exploited open-source Remote Access Trojan (RAT) that enables adversaries to execute commands remotely, exfiltrate data, and conduct covert surveillance on Windows systems. Current campaigns abuse legitimate infrastructure, such as Dropbox links and TryCloudflare tunnels. The infection chain typically initiates with an LNK file, followed by JavaScript and batch scripts that ultimately deploy Python-based loaders while displaying a deceptive invoice PDF. Persistence is achieved via startup-folder batch scripts and code injection into explorer.exe. Regional campaigns have observed C2 traffic utilizing TCP ports 6606, 7707, and 8808.

XWorm

XWorm is a modular RAT, available through MaaS channels since 2022, offering a range of malicious capabilities including credential theft, keylogging, webcam access, DDoS attacks, and ransomware deployment plugins. The 2026 infection chain typically starts with phishing emails containing ZIP attachments, often disguised as payment confirmations. These attachments extract a malicious JavaScript loader that establishes persistence in the Startup folder and retrieves a Base64-encoded DLL appended to a JPEG file hosted on public image services. The payload is then injected into MSBuild.exe or Aspnet_compiler.exe via process hollowing for fileless execution. Newer variants have been observed exploiting the WinRAR flaw CVE-2025-8088 and CVE-2018-0802 in Excel to bypass detection.

Remcos RAT

Initially a legitimate remote administration tool, Remcos has been extensively misused as a surveillance-as-a-service RAT. Its capabilities include live webcam streaming, real-time keylogging, credential theft, and screen capture. The primary infection vector remains phishing emails containing malicious ZIP or LNK attachments, followed by text-based staging and the abuse of legitimate Microsoft Living-off-the-Land Binaries (LOLBins) like MSBuild.exe to evade detection. Education, professional services, and finance sectors in Latin America (Colombia, Brazil) and the U.S. are the most frequent targets, with C2 traffic often routed through Dynamic DNS providers such as DuckDNS. Additional insights into Remcos’ evolution can be found in Lumu’s analysis.

Stealc

Stealc is a modular, MaaS infostealer designed to target a wide array of sensitive data, including information from browsers, FTP clients, messaging applications, email clients, gaming platforms, and cryptocurrency wallets. Its V2 iteration introduced RC4 encryption for stolen data, enhancing its stealth. It propagates through various channels, including phishing attachments, malvertising, drive-by downloads, and compromised cracked software/keygen sites. Stealc is frequently observed bundled with other cybercrime services, such as Amadey.

Lumma Stealer

Lumma (LummaC2), a subscription-based MaaS infostealer, has re-emerged with more sophisticated tactics following a law enforcement takedown of its core infrastructure. Current delivery methods include deceptive CAPTCHA “ClickFix” pages that trick victims into executing malicious PowerShell commands via the Windows Run dialog. Other vectors involve trojanized GitHub repositories featuring AI-generated README files promoting game cheats, and coordinated YouTube video campaigns linking to malicious downloads. Trend Micro provides further details on Lumma Stealer’s return.

Formbook

Formbook is a long-standing data stealer and form-grabber, sold as MaaS since 2016. It offers capabilities such as keylogging, screenshot capture, credential theft, and the ability to stage additional malware. Recent campaigns leverage phishing emails with RAR attachments that abuse DLL sideloading, or obfuscated JavaScript embedded in PDFs. Older campaigns exploited CVE-2017-11882 in Microsoft Equation Editor through malicious Word documents. Aerospace, defense contractors, and manufacturing sectors in the U.S. and South Korea have been disproportionately targeted. More information on Formbook campaigns is available from Google Cloud.

Quasar RAT

Quasar is an open-source, C#-based RAT that provides attackers with extensive remote control over compromised systems, including registry editing, keylogging, password theft, and file exfiltration. It is commonly delivered via malicious RTF or Office documents that trigger PowerShell payload downloads. Newer variants utilize dual DLL sideloading techniques to drop and execute payloads without triggering standard detection mechanisms.

AgentTesla

AgentTesla is a .NET-based RAT and advanced keylogger that has been active since 2014. Its functionalities include clipboard logging, screen capture, and the theft of stored browser and email credentials. It is primarily delivered through phishing emails that exploit Microsoft Office vulnerabilities CVE-2017-11882 and CVE-2017-8570. Exfiltrated data is typically sent via SMTP, FTP, or Telegram bot channels.

DonutLoader

DonutLoader is a shellcode-based loader that utilizes the “Donut” fileless execution framework to deploy secondary payloads, such as the PureLogs stealer, directly into memory. This approach helps avoid disk-based artifacts, enhancing stealth. Recent campaigns have employed “ClickFix”-style spoofed licensing websites, tricking victims into executing malicious PowerShell commands. These actions establish TCP-based C2 communications for data exfiltration and configuration retrieval. Further details on the Canndelta ClickFix campaign are available from Gurucul.

Known Infection Vectors

Phishing remains the most pervasive common denominator across all ten malware families, though the specific lures and payload staging techniques vary significantly depending on the malware family.

Known Tools and Living-off-the-Land Binaries Abused

Threat actors are increasingly leveraging legitimate, signed Windows utilities, known as Living-off-the-Land Binaries (LOLBins), to camouflage malicious activities within normal system operations and bypass signature-based detection.

• MSBuild.exe: Abused by XWorm and Remcos for reflective DLL injection and payload execution.
• Aspnet_compiler.exe: Utilized by XWorm for in-memory reflective DLL injection, as detailed by Trellix research.
• PowerShell (-nop, -ep bypass): Employed across XWorm, DonutLoader, and Lumma ClickFix chains for staged payload decryption and execution.
• wscript.exe / mshta.exe: Used to trigger JavaScript and HTA loaders in XWorm and Remcos campaigns.
• RegAsm.exe / RegSvcs.exe / InstallUtil.exe: Abused via process hollowing/injection by AgentTesla and Snake Keylogger.
• explorer.exe: A target for code injection in AsyncRAT campaigns, as highlighted in Trend Micro’s analysis.
• Python interpreter (legitimate installer): Deployed by AsyncRAT operators to run malicious scripts under a trusted runtime. Further details can be found in Trend Micro’s MDR analysis.
• Donut shellcode framework: Leveraged by DonutLoader for fileless, in-memory .NET assembly loading, as discussed by Gurucul.

Targeted Industries

Common Vulnerabilities Exploited (CVEs)

Beyond these documented CVEs, most malware families rely on social engineering and the abuse of legitimate tools rather than novel zero-day exploits. This trend emphasizes that patch management alone is insufficient; robust user-behavior controls and strict macro/script restrictions are equally crucial for effective defense.

Indicators of Compromise (IOCs)

File Hashes

Malicious Domains and URLs

IP Addresses

Malware	IP Address
XWorm	204.10.160.190 (C2, TCP port 7003)
Remcos	107.172.139.23, 193.230.215.22, 94.198.96.165
Lumma	144.76.173[.]247, 45.9.74[.]78, 77.73.134[.]68
Lumma	82.117.255[.]127, 82.118.23[.]50
AgentTesla	79.110.48[.]52, 193.42.33.51
Snake Keylogger	89[.]208[.]29[.]130, 69[.]55[.]5[.] Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources. Tags: CVEExploitMalwarePatchphishingransomwareSecurityThreatVulnerabilityzero-day Share Article Link Copied! David kimber David is a penetration tester turned security journalist with expertise in mobile security, IoT vulnerabilities, and exploit development. As an OSCP-certified security professional, David brings hands-on technical experience to his reporting on vulnerabilities and security research. His articles often feature detailed technical analysis of exploits and provide actionable defense recommendations. David maintains an active presence in the security research community and has contributed to multiple open-source security tools. Previous Post Critical Claude AI Vulnerability Exposes Local Files to Malicious Repositories Next Post Critical WalletService Flaw (CVE-2024-XXXX) Lets Attackers Control Windows Systems No Comment! Be the first one. Leave a Reply Cancel reply Your email address will not be published. Required fields are marked * Save my name, email, and website in this browser for the next time I comment. Related Posts By Jennifer sherman Threats GlassWorm Attacks macOS via Malicious VS Code… January 1, 2026 By Emy Elsamnoudy Attacks ClickFix Attack Hides Malicious Code via Stegan Security January 1, 2026 By Sarah simpson Vulnerabilities MongoBleed Detector Tool Released to Detect MongoDB Vulnerability(CVE-2025-14847) January 1, 2026 By Emy Elsamnoudy Breaches Conti Ransomware Gang Leaders & Infrastructure Exposed January 1, 2026