Skip to main content
AnalysisPublished

First half of 2026 malware trends

Source Reddit Malware

0

Discussion

This report summarizes malware trends observed in the first half of 2026, highlighting shifts in attacker focus and techniques. Infostealers increasingly target session tokens, cookies, recovery codes, and cryptowallet data rather than traditional passwords. Malicious shortcut files (LNK) remain a common infection vector. There is a notable rise in abuse of legitimate platforms through SEO poisoning, malvertising, fraudulent code signing, and compromises of software repositories such as npm, PyPI, and Crates.io. Supply chain attacks targeting software delivery channels and CI/CD pipelines are growing. Remote Management and Monitoring (RMM) tools are frequently abused due to their signed status and low detection rates. Legitimate websites are increasingly compromised to host malicious code via administrator account takeover or unpatched vulnerabilities. Popular exfiltration channels include Discord, Telegram, and GoFile, used for data theft and evasion. Dead drop resolvers and blockchain infrastructure abuse are also prevalent. The report does not describe a specific vulnerability or exploit but provides an overview of evolving malware tactics.

r/Malware (opens in a new tab)u/rifteyy_0 points0 comments

  1. Infostealers are more focused on session tokens, cookies, recovery codes, cryptowallet data that allows them to take over rather than the traditional password compromises.
  2. Malicious LNK (shortcuts) still remain a popular entry point to compromises, as they allow malicious code execution
  3. Large increase in abuse of legitimate platforms or impersonation - SEO poisoning, malvertising, fraudulent codesigning and compromises of npm packages, VSCode extesnions
  4. Supply chain attacks! Threat actors increasingly target software delivery channels like npm packages, PyPI, Crates.io, and CI/CD publications to include malware.
  5. Abuse of RMM tools continues & increases consistently! Initially, a signed tool with low detection ratio may seem legitimate, but remote management software such as ScreenConnect, Action1, Atera are vulnerable to abuse.
  6. A large increase was found in legitimate sites spreading ClickFix attacks. This can be done by numerous reasons - administrator account compromise, weak password security, unpatched vulnerabilities in website building platforms (such as WordPress) that allow threat actors to take over the website and host malicious code.
  7. Discord, Telegram, GoFile still remain as relevant exfiltration channels. While they do not provide as much flexibility as a regular C2 would, malware can still upload stolen data (passwords, files etc.) to it for the attacker to view. Easy to setup, used to evade detection. If you are interested in intercepting data from a Telegram exfiltration channel that malware uses, check out https://any.run/cybersecurity-blog/intercept-stolen-data-in-telegram/
  8. Dead drop resolvers are still popular! You can use it as an infrastructure layer if necessary to change the configuration. Very popular is abuse of smart contracts, blockchain infrastructure (EtherHiding) but Steam, Telegram or Pinterest profiles are a popular target as well.

See full analysis at https://any.run/cybersecurity-blog/h1-2026-cyber-risk-report

Links cited in the discussion

References

Community reviews

Loading reviews…