Top 10 Malware Used by Hackers Between July 20-26, 2026, to Launch Cyberattacks

Weekly threat telemetry from ANY.RUN’s interactive sandbox shows Vidar stealer, AsyncRAT, and XWorm remained the three most-uploaded malware samples analyzed by security teams during the week of July 20-26, 2026, collectively accounting for hundreds of sandbox detonations as defenders raced to triage phishing-driven intrusions.

The malware ranking reflects total sample uploads to a public malware analysis sandbox and captures the tools that red teams, SOC analysts, and threat hunters are most frequently encountering in the wild.

Info-stealers (Vidar, Stealc, Lumma) and Remote Access Trojans/RATs (AsyncRAT, XWorm, Remcos, Quasar) dominate the list, reflecting the continued commoditization of Malware-as-a-Service (MaaS) offerings sold on underground forums.

Vidar led the charts with 235 total uploads despite a weekly decline of 47 samples, while AsyncRAT followed closely at 214 uploads (down 60), and XWorm posted 205 uploads with a rare weekly increase of 13 samples, signaling renewed campaign activity.

Rank	Malware Family	Type	Total Uploads	Weekly Change
1	Vidar	Infostealer	235	-47
2	AsyncRAT	RAT	214	-60
3	XWorm	RAT	205	+13
4	Remcos	RAT/Surveillanceware	158	-36
5	Stealc	Infostealer	126	-44
6	Lumma	Infostealer	121	-21
7	Formbook	Infostealer	113	+41
8	Quasar	RAT	109	-6
9	AgentTesla	Infostealer/Keylogger	108	-59
10	DonutLoader	Loader	99	-58

Formbook and XWorm were the only families to trend upward for the week, an important signal for defenders since rising upload counts often precede a spike in active campaigns targeting new lures or vulnerabilities.

AgentTesla and DonutLoader saw the steepest declines, dropping 59 and 58 samples respectively, though both remain firmly embedded in commodity phishing kits.

Threat Family Profiles

Vidar Stealer

Vidar is a forked, Arkei-based information stealer operating as malware-as-a-service that harvests browser credentials, cookies, two-factor authentication data, Tor Browser configurations, and cryptocurrency wallets.

Recent 2026 campaigns show Vidar delivered through malvertising leading to fake cracked-software downloads, and via trojanized GitHub repositories disguised as legitimate developer tools, with payloads embedded in JPEG and TXT files for in-memory execution.

A parallel campaign combines Vidar with the XMRig cryptominer using DLL sideloading via a Go-compiled fake MpClient.dll for evasion.

AsyncRAT

AsyncRAT is a widely abused open-source Remote Access Trojan that provides remote command execution, data exfiltration, and covert surveillance of Windows systems.

Current campaigns abuse legitimate infrastructure such as Dropbox links and TryCloudflare tunnels, employing a multi-stage chain starting with an LNK file, followed by JS and BAT scripts that ultimately deploy Python-based loaders while displaying a decoy invoice PDF.

Persistence is established through startup-folder batch scripts and code injection into explorer.exe, and one regional campaign observed C2 traffic on TCP ports 6606, 7707, and 8808.

XWorm

XWorm is a modular RAT sold through malware-as-a-service channels since 2022, offering credential theft, keylogging, webcam access, DDoS, and ransomware-deployment plugins.

The 2026 infection chain begins with phishing emails containing ZIP attachments (e.g., disguised as payment confirmations), extracting a malicious JavaScript loader that establishes Startup persistence and retrieves a Base64-encoded DLL appended to a JPEG hosted on public image services.

The payload is injected into MSBuild.exe or Aspnet_compiler.exe via process hollowing for fileless execution, and newer variants exploit the WinRAR flaw CVE-2025-8088 and CVE-2018-0802 in Excel to bypass detection.

Remcos RAT

Remcos began as a legitimate remote administration tool but is now abused as a surveillance-as-a-service RAT capable of live webcam streaming, instant keylogging, credential theft, and screen capture.

Phishing emails with malicious ZIP/LNK attachments remain the primary vector, followed by text-based staging and abuse of legitimate Microsoft LOLBins such as MSBuild.exe to evade detection.

Education, professional services, and finance sectors in Latin America (Colombia, Brazil) and the U.S. are the most targeted, with C2 traffic frequently routed through Dynamic DNS providers like DuckDNS.

Stealc

Stealc is a modular, malware-as-a-service infostealer targeting browsers, FTP clients, messaging apps, email clients, gaming platforms, and cryptocurrency wallets, and its V2 iteration added RC4 encryption for stolen data.

It spreads through phishing attachments, malvertising, drive-by downloads, and cracked software/keygen sites, and is frequently bundled in cybercrime service chains alongside Amadey.

Lumma Stealer

Lumma (LummaC2) is a subscription-based MaaS infostealer that resurfaced with stealthier tactics after a law-enforcement takedown of its core infrastructure.

Current delivery methods include fake CAPTCHA “ClickFix” pages that trick victims into executing malicious PowerShell via the Windows Run dialog, trojanized GitHub repositories with AI-generated README files promoting game cheats, and coordinated YouTube video campaigns linking to malicious downloads.

Formbook

Formbook is a long-running data stealer and form-grabber sold as MaaS since 2016, capable of keylogging, screenshot capture, credential theft, and staging additional malware.

Recent campaigns use phishing emails with RAR attachments abusing DLL sideloading, or obfuscated JavaScript embedded in PDFs, while older waves exploited CVE-2017-11882 in Microsoft Equation Editor via malicious Word documents. Aerospace, defense contractors, and manufacturing sectors in the U.S. and South Korea have been disproportionately targeted.

Quasar RAT

Quasar is an open-source, C#-based RAT that grants attackers full remote control, including registry editing, keylogging, password theft, and file exfiltration.

It is commonly delivered via malicious RTF/Office documents that trigger PowerShell payload downloads, and newer variants use dual DLL sideloading to drop and execute payloads without triggering standard detections.

AgentTesla

AgentTesla is a .NET-based RAT and advanced keylogger active since 2014, capable of clipboard logging, screen capture, and stealing stored browser and email credentials.

It is chiefly delivered through phishing emails exploiting Microsoft Office vulnerabilities CVE-2017-11882 and CVE-2017-8570, with data typically exfiltrated via SMTP, FTP, or Telegram bot channels.

DonutLoader

DonutLoader is a shellcode-based loader leveraging the “Donut” fileless execution framework to deploy secondary payloads such as PureLogs stealer in-memory, avoiding disk-based artifacts.

Recent campaigns use ClickFix-style spoofed licensing websites that trick victims into running malicious PowerShell commands, establishing TCP-based C2 for data exfiltration and configuration retrieval.

Known Infection Vectors

Phishing remains the dominant common denominator across all ten families, but the specific lure and payload staging techniques vary significantly by malware family.

Infection Vector	Malware Families Using It
Phishing email with ZIP/RAR archive attachment	AsyncRAT, XWorm, Remcos, Formbook
Malicious Office document (macro/exploit)	AgentTesla, Quasar, Formbook, Snake Keylogger
Malvertising / fake cracked software	Vidar, Stealc, Lumma
Trojanized GitHub repositories	Vidar, Lumma
Fake CAPTCHA / ClickFix PowerShell execution	Lumma, DonutLoader
LNK/JS/BAT multi-stage script chains	AsyncRAT, XWorm
PDF or image (JPEG) steganographic payloads	XWorm, Vidar
Dropbox/TryCloudflare abused infrastructure	AsyncRAT

Threat actors increasingly favor legitimate, signed Windows utilities (LOLBins) to blend malicious activity into normal system noise and defeat signature-based detection.

• MSBuild.exe abused by XWorm and Remcos for reflective DLL injection and payload execution
• Aspnet_compiler.exe used by XWorm for in-memory reflective DLL injection
• PowerShell (-nop, -ep bypass) used across XWorm, DonutLoader, and Lumma ClickFix chains for staged payload decryption and execution
• wscript.exe / mshta.exe used to trigger JavaScript and HTA loaders in XWorm and Remcos campaigns
• RegAsm.exe / RegSvcs.exe / InstallUtil.exe abused via process hollowing/injection by AgentTesla and Snake Keylogger
• explorer.exe target of code injection in AsyncRAT campaigns
• Python interpreter (legitimate installer) deployed by AsyncRAT operators to run malicious scripts under a trusted runtime
• Donut shellcode framework used by DonutLoader for fileless in-memory .NET assembly loading

Targeted Industries

Industry	Malware Families Observed	Notes
Education & nonprofits	Remcos	Underfunded IT security, high-value data
Financial services	Remcos, AgentTesla	Credential and wire-fraud targeting
Aerospace & defense contractors	Formbook	High-value IP theft campaigns in US/South Korea
Manufacturing	Formbook	Targeted via archive-based phishing
Retail & hospitality	Snake Keylogger	Payment card and loyalty credential theft
Professional services & technology	Remcos, Stealc	MaaS-driven credential harvesting
Government (regional)	AsyncRAT, general loaders	Hijacked government sites used as delivery channels
SMBs and consumer users	Vidar, Lumma, Stealc	Malvertising and cracked-software targeting broad consumer base

Common Vulnerabilities Exploited (CVEs)

CVE	Vulnerability	Exploited By
CVE-2017-11882	Microsoft Equation Editor stack buffer overflow (RCE)	AgentTesla, Formbook
CVE-2017-8570	Microsoft Office RCE via OLE object	AgentTesla
CVE-2018-0802	Microsoft Office Equation Editor memory corruption	XWorm
CVE-2025-8088	WinRAR path traversal leading to arbitrary code execution	XWorm

Beyond these documented CVEs, most families rely on social engineering and legitimate-tool abuse rather than novel zero-days, underscoring that patch management alone is insufficient — user-behavior controls and macro/script restrictions are equally critical.

Indicators of Compromise (IOCs)

File Hashes

Malware	Hash Type	Value
AsyncRAT	SHA1 (zip)	55724b766dd1fe8bf9dd4cb7094b83b88d57d945
AsyncRAT	SHA1 (url)	4483561a49791a7cd684258e9f1623fe7dfba772
AsyncRAT	SHA1 (lnk)	0aa1b8fba8d7bd19a0064edfdf86c027da253644
XWorm	MD5 (weaponized archive)	2074283c9ccc441185cba631fcc8a234
Stealc	MD5 (sample)	9f34ab1c9d9351f59826b8d5c458a3d3
Quasar	SHA-256	cf7a24c9f2f9d85cc1ba4a11890087b82e38f39c8d194e808e9e6d82a188d3f0
Quasar	SHA-256	14b573b7e3ff8ad4e1489a5c039532f16f9eff34ead1d299f97fb0badf0affdc
Formbook	SHA1 (MalVirt loader)	15DB79699DCEF4EB5D731108AAD6F97B2DC0EC9C
Formbook	SHA1 (0onfirm .NET assembly)	655D0B6F6570B5E07834AA2DD8211845B4B59200
Formbook	SHA-256 (order0087.docx)	93CF566C0997D5DCD1129384420E4CE59764BD86FDABAAA8B74CAF5318BA9184
AgentTesla	MD5 (VBS file)	e2a4a40fe8c8823ed5a73cdc9a8fa9b9
AgentTesla	SHA256 (VBS file)	e7a157ba1819d7af9a5f66aa9e161cce68d20792d117a90332ff797cbbd8aaa5
AgentTesla	MD5 (final payload)	dd94daef4081f63cf4751c3689045213
AgentTesla	MD5 (COVID doc sample)	527142E25A8229D1DC910AF23CDB5256
DonutLoader	SHA-256	0099deccd390e229895d0c508882632569f9533e42d33a675885ee7f4f5164f3
DonutLoader	SHA-256	61b453cfedc6c67d9744b963bc3cabbee33f53606fdbf80da04bc3d4c93eb4fb
DonutLoader	SHA-256	9bb96fa6aee45120d14660506320932691310adef4353e684775f590a17c22fc
Snake Keylogger	MD5	c79d8b7c07b992c6aa435e4101770f99
Snake Keylogger	MD5 (ageless.exe)	f8410bcd14256d6d355d7076a78c074f
Snake Keylogger	MD5 (ageless.vbs)	77f8db41b320c0ba463c1b9b259cfd1b
Quasar (ISO sample)	MD5	e4eb623a0f675960acb002d225c6f1d6
Quasar (eBill loader)	MD5	B625C18E177D5BEB5A6F6432CCF46FB3

Malicious Domains and URLs

Malware	Domain / URL
AsyncRAT	inventory-card-thumbzilla-ip[.]trycloudflare[.]com
AsyncRAT	mercy-synopsis-notify-motels[.]trycloudflare[.]com/ma[.]zip
AsyncRAT	sufficiently-points-est-minimize[.]trycloudflare[.]com/ma[.]zip
AsyncRAT (regional)	ck44jili[.]com, mail.emb666[.]com
XWorm	kolanga[.]cc
Remcos	Nrmlogistics[.]ro (loader)
Remcos	Dentalux202[.]ydns[.]eu (C2)
Lumma	futureddospzmvq[.]shop, writerospzm[.]shop, mennyudosirso[.]shop
Lumma	deallerospfosu[.]shop, quialitsuzoxm[.]shop, complaintsipzzx[.]shop
Formbook	www.togsfortoads[.]com, www.popimart[.]xyz
Snake Keylogger	varders[.]kozow[.]com:8081, aborters[.]duckdns[.]org:8081
Snake Keylogger	anotherarmy[.]dns[.]army:8081
DonutLoader	canndelta[.]com
DonutLoader	158.94.208.104/x7GkP2mQ9zL4/my_new_l.bin
Formbook (image relay)	www2[.]0zz0[.]com/2025/02/02/10/709869215.png

IP Addresses

Malware	IP Address
XWorm	204.10.160.190 (C2, TCP port 7003)
Remcos	107.172.139.23, 193.230.215.22, 94.198.96.165
Lumma	144.76.173[.]247, 45.9.74[.]78, 77.73.134[.]68
Lumma	82.117.255[.]127, 82.118.23[.]50
AgentTesla	79.110.48[.]52, 193.42.33.51
Snake Keylogger	89[.]208[.]29[.]130, 69[.]55[.]5[.]249, 141[.]226[.]236[.]91, 3[.]23[.]155[.]57
Snake Keylogger	51[.]38[.]247[.]67 (C2 send endpoint)
DonutLoader	178.16.52.232, 158.94.208.92

Network Ports and Exfiltration Channels

Malware	Port/Channel	Purpose
AsyncRAT	TCP 6606, 7707, 8808	C2 communication
XWorm	TCP 7003	Encrypted keylog exfiltration
AgentTesla	api.telegram[.]org (Telegram Bot API)	Data exfiltration via bot tokens
Snake Keylogger	api[.]telegram[.]org/bot7034691123	Data exfiltration
AgentTesla	SMTP/FTP	Credential exfiltration channel

Defensive Recommendations for Cyber Defenders

Given that phishing and living-off-the-land technique abuse dominate this week’s top malware, defenders should prioritize layered controls over any single detection mechanism.

• Enforce email attachment filtering that blocks or sandboxes ZIP, RAR, ISO, LNK, and JS/VBS/HTA attachments by default
• Patch Microsoft Office and WinRAR immediately to close CVE-2017-11882, CVE-2017-8570, CVE-2018-0802, and CVE-2025-8088
• Monitor for anomalous process lineages such as PowerShell spawning MSBuild.exe, Aspnet_compiler.exe, or RegAsm.exe, which indicate reflective DLL injection or process hollowing
• Deploy DNS monitoring for Dynamic DNS providers (DuckDNS, ydns.eu, dns.army) and TryCloudflare tunnel subdomains frequently abused as C2 infrastructure
• Restrict execution of scripts from %APPDATA%, %TEMP%, and Startup folders via Software Restriction Policies or AppLocker
• Block outbound Telegram Bot API traffic where not business-justified, since multiple families exfiltrate data via Telegram channels
• Enforce MFA universally to blunt the impact of credential theft from infostealers like Vidar, Stealc, and Lumma
• Disable Office macros by default and restrict VBScript execution through Group Policy

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.