Top 10 Malware Used by Hackers Last Week to Launch Cyberattacks

Cybercriminals continued to lean on a familiar arsenal of malware last week, with information stealers and remote access trojans (RATs) dominating the threat landscape as the primary tools for initial access, credential theft, and long-term system control.

Topping the list is Vidar, an infostealer that logged 282 detections, narrowly edging out AsyncRAT, a widely abused open-source RAT that recorded 275 hits despite a sharp weekly decline. Remcos and XWorm rounded out the top four with 195 and 192 detections respectively, underscoring how threat actors continue to favor modular RATs capable of keylogging, webcam surveillance, and remote desktop control for espionage and financial theft.

Weekly telemetry from ANY.RUN’s interactive sandbox for the period ending July 20, 2026 shows malware activity concentrated around ten repeat-offender families rather than a wave of new threats.

Vidar (282 uploads) and AsyncRAT (275 uploads) top the chart, followed by Remcos, Xworm, StealC, AgentTesla, DonutLoader, Lumma, Snake Keylogger, and Quasar.

Nine of ten families saw uploads decline week-over-week, with AsyncRAT’s activity dropping by 1,431 detections, the sharpest fall in the set, while Lumma (+18) and Snake (+28) were the only families trending upward.

For defenders, the real signal isn’t the appearance of unfamiliar malware names; it’s the velocity of change within a stable roster.

A steep drop in a historically dominant family (AsyncRAT, Vidar) often indicates infrastructure takedown, builder disruption, or threat-actor migration to a successor tool, while a rising family (Lumma, Snake) signals where a MaaS operator is reinvesting effort and where detection coverage may lag.

This report unpacks each of the ten families with infection vectors, targeted industries, exploited vulnerabilities, and consolidated IOCs for direct ingestion into detection pipelines to protect against ongoing cyberattacks.

Weekly Ranking Snapshot

Rank	Family	Total Uploads	Weekly Change	Type
1	Vidar	282	-122	Infostealer
2	AsyncRAT	275	-1,431	RAT
3	Remcos	195	-48	RAT
4	Xworm	192	-137	RAT
5	StealC	170	-138	Infostealer
6	AgentTesla	167	-82	Spyware/Keylogger
7	DonutLoader	157	-6	Loader
8	Lumma	142	+18	Infostealer
9	Snake Keylogger	135	+28	Keylogger
10	Quasar	115	-37	RAT

1. Vidar Stealer

Vidar is a C++/C-based information stealer active since December 2018, believed to originate from a Russian-speaking developer group, and sold as Malware-as-a-Service (MaaS) with a “PRO” tier priced around 700 dollars.

In October 2025 its operator released Vidar 2.0, a complete rewrite in pure C with multithreaded architecture, coinciding with a sharp decline in StealC and Lumma activity as criminals migrated toward it. A campaign tracked into mid-2026 combined code-signing abuse, Go-compiled loaders, and DLL sideloading via a fake MpClient.dll to primarily hit organizations in the U.S. and EU.

Infection Vectors

• Malvertising luring victims to download password-protected .bin archives disguised as cracked/pirated software
• Multi-stage AutoIt loaders abusing Windows-native tools (e.g., MicrosoftToolkit.exe spawning command shells)
• Malicious JPEG/TXT-disguised payloads executed directly in memory
• Spam email attachments, often paired with AgentTesla or NanoCore campaigns
• Gaming “hack” clients and shady freeware bundles

Targeted Industries: No fixed vertical focus; recent campaigns concentrated on U.S. and EU enterprises broadly, spanning technology, professional services, and general commercial targets. Vidar also appears as a secondary payload in STOP/DJVU ransomware intrusions.

Vulnerabilities/Techniques Exploited: Rogue/unauthorized code-signing certificates (e.g., spoofed JustWatch and BleacherReport certs), in-memory AMSI bypass, binary inflation with null-byte padding to evade size-based scanning. No specific CVE is required infection relies on social engineering and living-off-the-land execution rather than a software exploit.

Indicators of Compromise

• C2 discovery via Telegram/Mastodon profile descriptions containing embedded IP addresses
• HTTP GET requests with empty User-Agent and Host headers, target URI of 4 digits (campaign ID) followed by requests for a 10-digit filename + .zip
• Dropped legitimate third-party DLLs: vcruntime140.dll, freebl3.dll, mozglue.dll, sqlite3.dll, nss3.dll, softokn3.dll, msvcp140.dll
• Fake certificate CNs mimicking JustWatch and BleacherReport.com
• File: MpClient.dll loaded from non-standard paths (loader payload)
• Persistence via registry Run key modifications and scheduled tasks

2. AsyncRAT

AsyncRAT is an open-source .NET/C# remote access trojan first published on GitHub under the handle “NYANxCAT” in January 2019; by 2026 it has over 40 active forks and is ranked the second most active malware family globally behind CobaltStrike per Maltiverse telemetry.

Despite topping last week’s chart by volume, it recorded the single largest week-over-week decline of any family in the top 10, dropping 1,431 detections consistent with periodic law-enforcement or infrastructure disruptions that regularly hit AsyncRAT’s C2 fleets .

Infection Vectors

• Phishing emails with ZIP attachments containing .wsf scripts or OneNote (.hta) files that trigger batch (.bat) execution
• Malicious Excel spreadsheets (.xls) that drop a second .xls to trigger VBA macros and reach out to C2
• Dropbox links leading to Internet Shortcut (.url) files that redirect to TryCloudflare-hosted multi-stage scripts, installing a Python environment and injecting code into explorer.exe
• Exploitation of CVE-2022-30190 (Follina/MSDT “Dogwalk”) for arbitrary code execution
• Malicious ZIP, ISO, or HTML email attachments (MSIL variant)

Targeted Industries: Financial services (45.5%), education/nonprofits (32.7%), healthcare (6.9%), government (5.9%), and manufacturing (4.0%), per Maltiverse sighting data; geographically concentrated in Ecuador, Colombia, and Brazil, with growing presence in North America and Europe. Additional sector reporting lists healthcare, aerospace, technology, hospitality, business services, and finance as consistently targeted.

Vulnerabilities/Techniques Exploited: CVE-2022-30190 (Follina); abuse of Cloudflare free-tier tunneling infrastructure for payload hosting; AMSI bypass and process injection into aspnet_compiler.exe or explorer.exe.

Indicators of Compromise

• TLS certificate CN=”AsyncRAT Server” / “AsyncRAT”
• Certificate SHA-256 fingerprint: 136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe
• Default C2 ports: 8808, 6606, 7707
• Final payload filename observed: new.bin, staged via TryCloudflare subdomains
• Persistence: startup folder scripts, scheduled tasks referencing %APPDATA%/%TEMP% paths, registry Run key additions
• Delivery artifact chain: Dropbox link → .url shortcut → Python installer script → explorer.exe injection

3. Remcos RAT

Remcos is a commercially sold remote administration tool from Breaking Security (Hong Kong-registered), marketed for legitimate remote management but widely abused for espionage and credential theft. It exploits CVE-2017-0199 (Microsoft Office OLE2Link) to deliver fileless payloads, and a 2026 variant shifted from local data storage to live, real-time C2-based surveillance including webcam streaming.

Infection Vectors

• Phishing emails with malicious Office document attachments exploiting application vulnerabilities
• Layoff/HR-themed phishing emails delivering NSIS-compiled Remcos executables disguised as “staff record” PDFs
• Google Cloud Storage-hosted phishing links
• Compromised websites hosting Remcos installer payloads
• DonutLoader shellcode with AutoIt staging and LOLBin abuse for in-memory execution

Targeted Industries: Financial services, healthcare, government, and general enterprise targets that receive high email volume (HR/invoice-themed lures suggest broad corporate targeting, with critical infrastructure repeatedly named in threat reporting).

Vulnerabilities/Techniques Exploited: CVE-2017-0199 (Microsoft Office OLE2Link RCE). Recent campaigns also weaponize WinRAR path-traversal flaws to drop fileless .NET RAT payloads.

Indicators of Compromise

• Registry key pattern: HKEY_CURRENT_USERSoftwareRemcos-{digits_letters} strong host-based indicator of unauthorized deployment
• Malicious file naming convention: “staff record.pdf” (actually NSIS-compiled Remcos binary)
• Detection signature: Trojan.Remcos.S38451216
• C2 traffic shift from batch local logging to persistent live-stream connections (webcam/mic exfiltration)
• Delivery chain: batch file → encoded PowerShell → DonutLoader shellcode → AutoIt stager

4. Xworm

Xworm is a modular, MaaS-distributed RAT first seen in July 2022, believed to originate in the ex-USSR region, developed in .NET, and capable of ransomware deployment, DDoS, and cryptocurrency/credential theft.

A May 2026 Trellix report noted Xworm’s rise to the #3 global threat position, driven by memory-only execution and abuse of the WinRAR CVE-2025-8088 exploit.

Infection Vectors

• Phishing emails with Word documents that load a remote .rtf containing an Excel spreadsheet with macros, which runs PowerShell to fetch Xworm
• LNK files disguised as invoices, executing hidden PowerShell that copies/runs a batch file
• Shellcode-based multi-stage delivery using steganography and reflective DLL injection
• Exploitation of the WinRAR path-traversal flaw CVE-2025-8088
• Exploitation of the Follina vulnerability CVE-2022-30190 via malicious .docx files (observed in a German business-targeted campaign)

Targeted Industries: Hospitality (UK campaigns spoofing Booking.com), with broader country-level targeting spanning the UK, Spain, Russia, Ukraine, India, the US, and Germany.

Vulnerabilities/Techniques Exploited: CVE-2025-8088 (WinRAR), CVE-2022-30190 (Follina). UAC bypass attempts to gain administrator rights and modify registry for persistence.

Indicators of Compromise

• Dropped file paths: C:UsersadminAppDataRoamingMicrosoftWindowsStart MenuProgramsStartupXWorm.exe and C:UsersadminAppDataRoamingXWorm.exe
• Persistence via Task Scheduler service tied to the Roaming-directory copy
• Associated loader tools seen in delivery chains: Freeze[.]rs, SYK Crypter (also used to drop Remcos, njRAT, RedLine)
• Spoofed sender domain pattern impersonating Booking.com in hospitality-sector phishing
• File formats observed in delivery: .rtf, .lnk, .pdf, .docx

5. StealC

StealC is a C-based infostealer sold via a self-hosted PHP control panel since January 2023, designed to steal browser, messenger, and crypto-wallet data, and to drop secondary payloads such as Laplas Clipper.

Notably, StealC infrastructure was seized on June 24, 2026 during Operation Endgame, a law-enforcement action led by Germany’s BKA and coordinated by Europol that also hit the Amadey loader; this explains StealC’s ongoing weekly decline even before the takedown, as activity had already fallen more than 90 percent from its January 2026 peak.

Infection Vectors

• Fake websites offering legitimate software downloads that deliver StealC instead
• Malicious email attachments (Office documents, PDFs)
• Distribution via the Amadey loader and the CrackedCantil loader, which also drops Lumma, RisePro, and RedLine
• MSI packages and PowerShell scripts as expanded delivery formats in StealC V2

Targeted Industries: No specific vertical concentration reported; StealC targets individual credential stores broadly (browsers, crypto wallets, gaming apps, VPNs, email clients) rather than particular sectors.

Vulnerabilities/Techniques Exploited: No CVE-based exploitation reported; relies on social engineering and loader-chain delivery. StealC’s own control-panel vulnerabilities were exploited by researchers, contributing to its 2026 collapse in prevalence ahead of the June takedown.

Indicators of Compromise

• Downloaded third-party DLLs required for browser data theft: sqlite3.dll, freebl3.dll, mozglue.dll, nss3.dll, vcruntime140.dll, softokn3.dll, msvcp140.dll
• C2 communication pattern: HTTP POST exfiltration following an initial configuration-request handshake
• Operation Endgame seizure metrics relevant for retrospective hunting: over 100 domains and hundreds of servers seized, ~27 million credentials recovered, $47M+ in crypto frozen
• Co-occurrence indicator: StealC frequently deployed alongside or via Amadey loader infrastructure

6. AgentTesla

AgentTesla is a .NET-based spyware/keylogger sold since 2014 on a dedicated storefront (with prices from 15 to 70 dollars) and Discord-based support, believed to originate from Turkey, with over 6,300 documented purchasers. It remains a top-tier credential-theft tool due to low cost and ease of use for less technical attackers.

Infection Vectors

• Malicious Word/Excel documents with embedded executables or exploits delivered via phishing
• Coronavirus/topical-lure themed spam campaigns
• Malicious web links that auto-download contaminated documents
• Proxy execution through trusted Windows utilities RegSvcs.exe and RegAsm.exe

Targeted Industries: Broad, opportunistic targeting across individuals and organizations in diverse sectors; commonly bundled in the same spam ecosystems as Vidar and IcedID.

Vulnerabilities/Techniques Exploited: CVE-2017-11882 and CVE-2017-8570 (Microsoft Office equation editor memory corruption flaws). Also uses double-extension archive tricks (e.g., invoice.zip containing a disguised executable).

Indicators of Compromise

• Process injection indicator: legitimate RegAsm.exe or RegSvcs.exe hijacked to perform data theft flagged in sandbox as “Actions looks like stealing of personal data”
• Payload staging directory: %TEMP%
• Unencrypted SMTP exfiltration channel occasionally exposing attacker’s own SMTP credentials in plaintext network streams
• Historical distribution domain: agenttesla[.]com (malware storefront, not a C2, but relevant for attribution)

7. DonutLoader

DonutLoader is a shellcode-based loader technique (leveraging the open-source “Donut” project) increasingly used as an intermediate stage to deploy Remcos, Pulsar RAT, and other stealers with minimal forensic footprint. Its weekly change was nearly flat (-6), suggesting steady, consistent use as a delivery mechanism rather than a maturing or declining campaign .

Infection Vectors

• Phishing emails using open redirects (e.g., abused Google App links) delivering a ZIP archive containing a malicious .url file
• Cloudflare tunnel and WebDAV abuse for remote payload staging
• Batch files with encoded commands that decrypt Donut shellcode via PowerShell
• Python runtime abuse for Early Bird APC injection into suspended legitimate processes
• Discord used as a C2 channel in some observed builds

Targeted Industries: Not sector-specific; documented against general business email recipients receiving invoice/billing-themed lures.

Vulnerabilities/Techniques Exploited: No CVE dependency relies on Living-off-the-Land Binaries (LOLBins), Early Bird APC injection, and in-memory execution to bypass disk-based AV scanning.

Indicators of Compromise

• Decoy PDF dropped to distract the victim while persistence is established
• Persistence location: Startup folder logon entries
• Final payload characteristic: in-memory .NET PE executed entirely from a Donut shellcode loader, minimizing forensic artifacts
• Registry Run key + hidden batch file placed in %AppData%
• Injection target: legitimate suspended process via Early Bird APC technique

8. Lumma Stealer

Lumma (LummaC2) is a MaaS infostealer active since 2022, believed operated from former-USSR territory, sold via three-tier Telegram-distributed subscriptions, and compatible with Windows 7 through 11 across x86, x64, and ARM architectures. It was the only top-3 stealer to gain uploads this week (+18), consistent with its documented resurgence as StealC’s takedown pushed criminal demand toward alternative stealers.

Infection Vectors

• Deceptive CAPTCHA/”human verification” screens tricking users into running malicious PowerShell (ClickFix technique)
• Abuse of Discord’s CDN to host and distribute payloads
• Fake browser update prompts
• Fake software download sites
• Direct Discord messaging to build trust before sending infected executables
• Compromised websites using EtherHiding combined with ClickFix tactics
• Malicious LNK files disguised as PDFs distributed through compromised educational-institution infrastructure

Targeted Industries: Healthcare, banking, marketing, telecom; also finance, healthcare, technology, and media in multi-stage campaigns tied to compromised edu infrastructure.

Vulnerabilities/Techniques Exploited: No specific CVE relies entirely on social engineering (ClickFix/CAPTCHA deception) rather than software exploitation. Post-infection activity in early 2026 showed a consistent pattern of adding scheduled tasks to escalate persistence.

Indicators of Compromise

• Detection signatures: Behavior:Win32/LummaStealer, Trojan:PowerShell/Powdow, Behavior:Win64/Shaolaod
• Technique marker: EtherHiding (data/commands embedded in blockchain transactions) used alongside ClickFix
• Post-infection behavior: repeated addition of scheduled tasks as a persistence/reinfection pattern
• Delivery format: malicious .lnk files masquerading as PDF documents
• Recommended file-type block list at mail gateway: exe, pif, tmp, url, vb, vbe, scr, reg, cer, pst, cmd, com, bat, dll, dat, hlp, hta, js, wsf

9. Snake Keylogger

Snake Keylogger (also tracked as 404 Keylogger) is a modular .NET credential stealer and keylogger first observed in November 2020, historically ranked the second most common malware family behind AgentTesla. It posted the largest percentage gain in the top 10 this week (+28), and a 2025 variant leveraging AutoIt scripting was tied to over 280 million blocked infection attempts globally.

Infection Vectors

• Malicious spam email with a .img (disk image) attachment; opening it mounts a virtual drive containing an executable masquerading as a PDF
• Malicious Office documents or PDFs requiring macro-enablement or exploitation of a vulnerable reader
• AutoIt-scripted downloader stages that decrypt and load obfuscated DLLs directly into memory
• Process injection into .NET Framework-related processes

Targeted Industries: Broad opportunistic targeting; the 2025 AutoIt variant specifically hit users in China, Turkey, Indonesia, Taiwan, and Spain. Corporate and personal credential theft is the primary objective across sectors.

Vulnerabilities/Techniques Exploited: No specific CVE depends on macro-enabled documents and vulnerable/outdated Office or PDF reader versions. Uses in-memory DLL loading and process hollowing/injection to avoid disk-based detection.

Indicators of Compromise

• Delivery artifact: .img disk image attachment mounting a virtual drive with a disguised Stage-1 executable
• Data theft targets confirmed in sandbox analysis: default Outlook profile credentials, browser login data, FileZilla stored FTP credentials
• Technique marker: process hollowing into .NET Framework processes for stealthy execution
• Co-occurring campaign: educational-institution infrastructure compromise used to deliver both Snake Keylogger and Lumma via malicious LNK files

10. Quasar RAT

Quasar is an open-source .NET RAT first documented in 2015 (evolved from the older xRAT codebase), consisting of a client-server architecture with a GUI-based management console; it was previously used in a 2017 campaign against the US government and later against private-sector targets. A 2026 variant pivoted toward developer-focused targeting, harvesting Git, NPM, and PyPI credentials rather than general end-user data.

Infection Vectors

• Email spam campaigns delivering a malicious document attachment, sometimes with double file extensions (e.g., docx.exe) to disguise the executable
• Malicious Microsoft Office file droppers that modify registry Run values for persistence
• Supply-chain-focused delivery targeting developer machines and CI/CD credential stores

Targeted Industries: Historically government and private-sector organizations; the newest campaign wave specifically targets software developers and DevOps environments across industries that rely on Git/NPM/PyPI package ecosystems.

Vulnerabilities/Techniques Exploited: No specific CVE reported; Quasar lacks sophisticated anti-analysis features compared to peers, relying instead on social engineering and scheduled-task/registry persistence.

Indicators of Compromise

• Persistence: schtasks-created scheduled task at highest run level (admin context) or registry Run-key value (non-admin context)
• Network marker: distinctive user-agent strings spoofing browser traffic used for C2 communication
• Credential-theft targets in the 2026 developer-focused variant: Git credentials, NPM tokens, PyPI credentials, and other repository secrets
• Detection method: Suricata IDS rule hits on C2 communication attempts, viewable under sandbox “Threats” panel

Consolidated Defender Checklist

Family	Primary Delivery	Key CVE(s)	Standout IOC Type
Vidar	Malvertising/cracked software	None (LOLBin-based)	Fake certs (JustWatch/BleacherReport spoof)
AsyncRAT	Phishing + Cloudflare tunnels	CVE-2022-30190	Cert fingerprint + ports 8808/6606/7707
Remcos	Office docs / HR-themed phishing	CVE-2017-0199	Registry key “Remcos-{ID}”
Xworm	LNK/macro phishing	CVE-2025-8088, CVE-2022-30190	Startup path XWorm.exe
StealC	Fake software/loader chains	None	Required DLL set (sqlite3.dll, etc.)
AgentTesla	Malicious Office docs	CVE-2017-11882, CVE-2017-8570	RegAsm.exe/RegSvcs.exe injection
DonutLoader	Open-redirect phishing	None (LOLBin/APC injection)	Donut shellcode in-memory PE
Lumma	ClickFix/CAPTCHA social engineering	None	EtherHiding + scheduled task abuse
Snake Keylogger	.img disk-image attachments	None	Outlook/FileZilla credential targeting
Quasar	Double-extension doc droppers	None	Git/NPM/PyPI credential theft (2026 variant)

The pattern across this week’s data reinforces a defense priority: file-based and CVE-based detection alone will miss most of these families, since seven of ten rely primarily on social engineering, LOLBins, or in-memory execution rather than software exploits.

Behavioral detection, registry/scheduled-task monitoring, and DNS/C2 pattern matching (especially for Telegram/Mastodon-based C2 discovery and Cloudflare-tunnel abuse) should be prioritized over signature-based tooling alone.

Taken together, this week’s rankings reflect a threat landscape where stealers and RATs remain the primary drivers of initial intrusion activity, even as the specific mix of families shifts from week to week.

For defenders, tracking these ranking changes offers an early warning system, helping security teams prioritize detection engineering and threat-hunting efforts around the families most actively fueling real-world cyberattacks.

❗ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure