Global malware and cyber threat evolution

Global malware activity continues to surge, driven by remote access trojans (RATs), information stealers, and loaders. AsyncRAT remains a dominant threat, with approximately 211 weekly sample uploads observed; it frequently utilizes trusted cloud infrastructure, such as Cloudflare, to evade detection. Remcos RAT has also seen a sharp rise in activity, with newer variants focusing on real-time surveillance capabilities like live webcam streaming and instant keystroke transmission.

Attackers are increasingly employing sophisticated delivery methods, such as using Visual Basic Script (VBS) and PowerShell to deploy malicious script chains. These chains often utilize DuckDNS hosts to distribute scripts that mimic legitimate Windows activity, employing AES-256 encryption and process hollowing to bypass security defenses and steal browser data, keystrokes, and clipboard contents.

Parallel to these technical shifts, threat actors are investing heavily in “dropcatch” domains to facilitate malware distribution, illegal gambling, and scams. In the first half of 2026, approximately 65,000 re-registered domains were observed daily, accounting for nearly 20% of all newly observed domains. High rates of this activity are noted in .net and .xyz extensions, where nearly 30% of new registrations are previously registered domains. By acquiring these, attackers exploit inherited reputation, backlinks, and web traffic to bypass security algorithms.

Specific actors have been identified using these methods: Sable Squirrel is estimated to have spent over $7 million to acquire more than 10,000 expired domains to support ecosystems involving illegal streaming and malware. Other actors, including Shady Squirrel, Stuffy Squirrel, and Swiping Squirrel, utilize these infrastructures for SocGholish “fake update” campaigns, advertising fraud, and scams.