{"id":10040,"date":"2026-10-19T08:25:00","date_gmt":"2026-10-19T08:25:00","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=10040"},"modified":"2026-10-19T08:25:00","modified_gmt":"2026-10-19T08:25:00","slug":"9-rising-malware-trends-every-security-pro-should-know","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=10040","title":{"rendered":"9 rising malware trends every security pro should know"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Malware is evolving rapidly, driven by advances in AI and changes in computing infrastructures.<\/p>\n

Security professionals must continuously educate themselves on these trends to defend against increasingly sophisticated threats.<\/p>\n

The traditional game of cat and mouse between security attackers and defenders has got fiercer with fresh techniques evolving and older less effective approaches falling out of fashion.<\/p>\n

Here is a look at what\u2019s heating up in the world of malware \u2014 and what\u2019s cooling off.<\/p>\n

<\/a>Infostealers commoditizing initial access<\/h2>\n

Infostealers have experienced huge growth<\/a> in the past 18 months, with malware such as Lumma Stealer<\/a>, StealC, and RisePro now responsible for 75% of all stolen credentials, according to cybersecurity vendor Immersive.<\/p>\n

Infostealers steal browser cookies, VPN credentials, multi-factor authentication (MFA) tokens, crypto wallet data, and more. Cybercriminals sell the data that infostealers grab through dark web markets<\/a>, giving attackers easy access to corporate systems.<\/p>\n

\u201cThis shift commoditizes initial access, enabling nation-state goals through simple transactions rather than complex attacks,\u201d says Ben McCarthy, lead cyber security engineer at Immersive.<\/p>\n

<\/a>Malicious packages targeting developer environments<\/h2>\n

Threat actors are systematically compromising the software supply chain by embedding malicious code within legitimate development tools, libraries, and frameworks that organizations use to build applications.<\/p>\n

\u201cThese supply chain attacks exploit the trust between developers and package repositories,\u201d Immersive\u2019s McCarthy tells CSO. \u201cMalicious packages often mimic legitimate ones while running harmful code, evading standard code reviews.\u201d<\/p>\n

Popular software development ecosystems such as NPM<\/a>, PyPI<\/a>, and AI platforms like HuggingFace<\/a> are frequent targets of malicious actors seeking to seed compromised packages in software developers\u2019 toolchains.<\/p>\n

Attackers continued to innovate in 2026 when targeting the software supply chain as a vector for malware delivery. For example, the Shai-Hulud attacks<\/a> involved self-propagating malware that stole CI\/CD secrets and hijacked GitHub Actions OIDC tokens to publish malicious package versions through victims\u2019 own release pipelines.<\/p>\n

Similar tactics were in play in other attacks.<\/p>\n

\u201cIn the Axios compromise<\/a>, attackers targeted the lead maintainer\u2019s credentials and inserted a malicious dependency into legitimate software releases,\u201d says Lindsey O\u2019Donnell-Welch, principal technical writer at managed detection and response firm Huntress. \u201cThis led to downstream dependencies downloading remote-access malware tailored to the operating system.\u201d<\/p>\n

<\/a>Ransomware becoming more targeted and sophisticated<\/h2>\n

The ransomware landscape<\/a> shifted dramatically after law enforcement cracked down on major groups like LockBit.<\/p>\n

Modern ransomware threat actors<\/a> such as RansomHub and Akira now favor smaller, highly targeted attacks, using ransomware as a final step after full infiltration and data exfiltration. This marks a move from broad, opportunistic strikes to focused, high-value campaigns.<\/p>\n

\u201cThese targeted approaches show threat actors\u2019 growing insight into specific vulnerabilities and their readiness to invest heavily in reconnaissance and tailored attack development,\u201d Immersive\u2019s McCarthy comments.<\/p>\n

These groups use advanced evasion techniques such as living-off-the-land (LOTL) tactics<\/a> and legitimate admin tools to stay hidden. They\u2019re also shifting from file encryption to data theft and extortion, threatening public leaks to pressure victims.<\/p>\n

\u201cThere\u2019s been a notable uptick in the use of cloud-based services and remote management platforms as part of ransomware toolchains,\u201d says Jamie Moles, senior technical marketing manager at network detection and response provider ExtraHop. \u201cThis aligns with a broader trend: Rather than relying solely on traditional malware payloads, adversaries are increasingly shifting toward abusing trusted platforms and \u2018living-off-the-land\u2019 techniques.\u201d<\/p>\n

Healthcare remains a top target of ransomware attacks<\/a>, while critical infrastructure faces increasing threats as attackers exploit the urgency that prompts quick ransom payments.<\/p>\n

<\/a>Malware adopting social engineering techniques<\/h2>\n

Cybercriminals are increasingly adopting ClickFix<\/a> as a malware delivery method in attacks that rely on social engineering techniques to successfully infect end-user devices.<\/p>\n

ClickFix tricks users into executing malicious code \u2014 usually a PowerShell script \u2014 on their own systems, taking advantage of growing user fatigue in having to jump through online hoops to \u2018prove you\u2019re human.\u2019<\/p>\n

By hijacking trust in familiar CAPTCHA processes, threat actors are getting users to actively participate in their own compromise \u2014 copying and pasting malicious commands into their systems under the guise of simple verification.<\/p>\n

\u201cWe\u2019ve seen this technique gain serious traction across phishing sites, compromised webpages, and social engineering campaigns,\u201d says Jim Walter, senior threat researcher at SentinelLABS. \u201cIt\u2019s simple, effective, and increasingly common.\u201d<\/p>\n

CISOs need to be wary of the threat because it bypasses many traditional detection methods by relying on human behavior rather than system vulnerabilities.<\/p>\n

\u201cRaising awareness, hardening endpoint execution policies, and deploying behavioral detection tools are essential to countering this wave of malware delivery,\u201d Walter advises.<\/p>\n

Threat actors continue to bring new flavors of ClickFix into play in 2026.<\/p>\n

For example, Huntress logged a ClickFix lure in April dressed up as a free image-editing tool, which then led to a loader called CastleLoader before the attack chain dropped NetSupport RAT and a custom .NET stealer.<\/p>\n

\u201cThe end goal was to steal browser credentials, wallet extension data, and Telegram session files,\u201d according to Huntress\u2019 O\u2019Donnell-Welch.<\/p>\n

<\/a><\/a>Polymorphic malware evading detection mechanisms<\/h2>\n

Polymorphic malware automatically modifies its code each time it replicates or infects a new system, making it difficult for signature-based detection methods to identify it.<\/p>\n

This type of malware is challenging for antivirus software to detect and for security researchers to analyze.<\/p>\n

Alex Hinchliffe, principal threat researcher at Unit 42, the threat intelligence and incident response arm at Palo Alto Networks, says, \u201cVery basic or specific detection mechanisms, such as hash-based scanners, are thwarted by polymorphism, but it\u2019s worth noting that each time a malicious program is compiled \u2014 e.g., into an executable \u2014 it will yield a new unique fingerprint or hash. Add to this the plethora of free and commercially available compressor, packer, and protector tools, which can be applied to a compiled program, and the \u2018same\u2019 program will yield yet more variations and permutations of the same fingerprint.\u201d<\/p>\n

Polymorphic malware also often uses encryption to hide its payload, further complicating detection and analysis.<\/p>\n

AI \u2018flattening\u2019 the once diverse malware development ecosystem<\/h2>\n

The malware ecosystem is consolidating and shrinking partly due to greater use of AI.<\/p>\n

\u201cThere isn\u2019t much of a necessity anymore for exploit kit developers, loaders, and feature-rich malware implants,\u201d says Adam Brown, principal threat intelligence analyst at Huntress.<\/p>\n

What once was a diverse and federated ecosystem of malware developers and service providers has been \u201cflattened with the introduction of AI, and the business efficiency of smash-and-grab intrusion techniques\u201d, Brown says.<\/p>\n

Threat actors frequently use trial accounts for their tooling (e.g., ScreenConnect) and cover their command and control (C2) and exfiltration routes under Cloudflare accounts.<\/p>\n

\u201cFree-cloud hosting is ubiquitous, negating the need and cost of bullet-proof hosters,\u201d Brown adds. \u201cAs long as defenses are disabled prior, free and commercial toolsets \u2014 Cobalt Strike, Meterpreter, Bloodhound, et al \u2014 work just as well.\u201d<\/p>\n

In addition, cybercriminal syndicates are increasingly forgoing investment in and development of fully featured trojans, exploit kits, and even dedicated hosting as part of a ruthless business-like optimization of cybercrime activity.<\/p>\n

\u201cIt is far more efficient for them [cybercrime syndicates] to disable defenses using legitimate executables \u2014 signed system drivers, remote management software, etc. \u2014 deploy easily coded info-stealers, leverage legitimate and ubiquitous tooling to laterally move, and execute a network-wide encryption of enterprise assets,\u201d Brown explains.<\/p>\n

AI is speeding up existing attacks<\/h2>\n

Although AI is yet to displace traditional attack methods, a range of security vendors report that attackers are using AI to make existing techniques faster and more convincing, while also allowing them to operate at greater scale.<\/p>\n

\u201cIt [AI] can help write phishing messages and automate reconnaissance, while also supporting faster vulnerability discovery and more realistic impersonation attempts,\u201d says Patricia Leppert, team manager of customer trust and security at TeamViewer.<\/p>\n

But attackers are also using AI to build malware and related tooling.<\/p>\n

eSentire Threat Research Unit reports logging signs of AI-assisted development by attackers ranging from ransomware affiliates to a North Korean cyberespionage group.<\/p>\n

\u201cAttackers use large language models (LLMs) such as ChatGPT, Claude, and DeepSeek to write loaders, droppers, admin panels and scripts, to convert code between languages, and to write social-engineering text,\u201d says Spence Hutchinson, senior manager of intelligence research at eSentire. \u201cThey get past the models\u2019 safeguards through jailbreaking, or through stolen and resold accounts.\u201d<\/p>\n

Attackers adopting modern development techniques<\/h2>\n

Malware developers are also using modern software development practices. For example, security vendor Barracuda reports a growing use of modern programming languages such as Rust and Go in malware, especially ransomware binaries.<\/p>\n

\u201cThese languages allow developers to build malware that is more portable and easier to adapt across operating systems,\u201d explains Christine Barry, senior chief cybersecurity storyteller and content manager for the office of the CTO at Barracuda. \u201cRather than maintaining separate malware families for Windows, Linux, and virtualization environments, threat actors can support multiple platforms from a common code base.\u201d<\/p>\n

Agentic AI enters the fray<\/h2>\n

Attackers are already using generative AI to create phishing emails, write malicious code, and accelerate social-engineering attacks. But agentic AI will push their capabilities further by combining LLMs with tools, memory, and decision-making capabilities that enable a malicious system to plan actions, adapt to obstacles, and pursue objectives autonomously.<\/p>\n

JadePuffer<\/a> offers a recent example of such an agentic AI attack.<\/p>\n

\u201cThis attack conducted reconnaissance, adapted to changing conditions, harvested credentials, moved through the target environment, and carried out destructive actions with limited evidence of human interaction or control,\u201d Barracuda\u2019s Barry says. \u201cResearchers also observed JadePuffer modifying its behavior when it encountered problems, allowing the attack to adapt to conditions that might interrupt a scripted attack.\u201d<\/p>\n

<\/a>Depreciated malware techniques<\/h2>\n

Some noticeable trends reflect a \u201cdownturn\u201d for malware and hacking techniques that have fallen out of fashion, mainly because their effectiveness has decreased due to advances in security defenses.<\/p>\n

For example, threat actors rely more on legitimate admin tools \u2014 such as Sysinternals Suite and living-off-the-land binaries (LOLBins) \u2014 for evasion and persistence, and less on malicious executables.<\/p>\n

\u201cOn the hacking tool front, we observed a decrease in the use of more comprehensive tool suites like Cobalt Strike and Sliver,\u201d says O\u2019Donnell-Welch of Huntress. \u201cHowever, threat actors continue to use specialized tools like Mimikatz and CrackMapExec for functionalities like password sniffing, memory dumping, privilege escalation, and lateral movement.\u201d<\/p>\n

Other once popular techniques that have fallen out of favor include:<\/p>\n

Network worms<\/strong>, such as Conficker, because modern networks now feature segmentation, automated patching, and strong endpoint defenses, all of which limit worm propagation<\/p>\n

Traditional botnets<\/strong><\/p>\n

Exploit kits<\/strong>, which were once a prevalent method for delivering malware through web-based attacks by scanning users\u2019 systems for known vulnerabilities in software such as Adobe Flash, Java, or Internet Explorer, and then exploiting those weaknesses to install malware<\/p>\n

Office macros<\/strong><\/p>\n

USB-based malware<\/strong><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Malware is evolving rapidly, driven by advances in AI and changes in computing infrastructures. Security professionals must continuously educate themselves on these trends to defend against increasingly sophisticated threats. The traditional game of cat and mouse between security attackers and defenders has got fiercer with fresh techniques evolving and older less effective approaches falling out […]<\/p>\n","protected":false},"author":0,"featured_media":10041,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-10040","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10040"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10040"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10040\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/10041"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10040"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10040"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10040"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}