Most Used Malware for Cyberattacks in Late July 2026

In the week spanning July 20-26, 2026, the cybersecurity landscape was dominated by a few notable malware families, according to ANY.RUN’s sandbox analyses. Prominent among these were Vidar stealer, AsyncRAT, and XWorm, which were frequently analyzed as defenders tackled phishing-induced breaches.

Leading Malware Threats

Vidar, AsyncRAT, and XWorm were the most frequently uploaded malware samples to public analysis platforms, indicating their prevalence in active cyber threats. This trend is significant for security experts, who are focusing on these threats in real-time threat management.

The malware landscape is heavily influenced by commodity Malware-as-a-Service (MaaS) offerings. Info-stealers like Vidar and Stealc, as well as Remote Access Trojans (RATs) such as AsyncRAT and XWorm, are gaining popularity due to their availability on underground forums.

Notable Malware Families

Vidar led the pack with 235 uploads, although it saw a decrease of 47 samples from the previous week. AsyncRAT followed with 214 uploads, while XWorm gained traction with a small increase, reaching 205 uploads. This increase in XWorm activity suggests a potential rise in targeted campaigns.

Formbook, alongside XWorm, showed an upward trend, which is often a precursor to expanded malware campaigns. Meanwhile, AgentTesla and DonutLoader experienced significant reductions in activity, yet remained prevalent in phishing attacks.

Details of Major Malware

Vidar Stealer: A derivative of Arkei, Vidar is widely used for stealing sensitive information such as browser credentials and cryptocurrency wallets. Recent campaigns utilized fake cracked software and GitHub repositories, embedding payloads for stealthy in-memory execution.

AsyncRAT: This open-source RAT is known for remote command execution and data theft. It exploits legitimate cloud services to deliver payloads through a multi-stage process, often involving deceptive invoice PDFs.

XWorm: Sold as a service, XWorm provides various malicious capabilities. It starts infection with phishing emails, leveraging ZIP attachments and JavaScript loaders to evade detection. Recent variants have exploited known vulnerabilities to enhance evasion techniques.

Future Outlook

The continuous evolution of malware-as-a-service platforms necessitates proactive defense measures. Cybersecurity teams must focus on enhanced detection and response strategies to mitigate these evolving threats.

As threat actors increasingly use legitimate software for malicious purposes, it becomes crucial to maintain robust monitoring and layered security controls. By anticipating these tactics, defenders can better protect against and respond to emerging cyber threats.