Global malware activity climbed sharply over the past week, with remote access trojans (RATs), information stealers, and loaders all posting significant week-over-week gains, according to threat sample uploads tracked by ANY.RUN.

AsyncRAT topped the chart with 211 uploads, edging out Remcos at 196 and Xworm at 183. This trend signals that RAT-based intrusions remain the dominant tactic for cybercriminals seeking persistent, hands-on-keyboard access to compromised Windows systems.

AsyncRAT held the number one position with 211 total uploads and a modest weekly increase of two samples, reflecting its status as one of the most consistently deployed .NET-based remote access trojans in the current threat landscape. The malware is typically delivered through phishing email attacks containing malicious attachments or links.

Once installed, it grants attackers full remote command execution, keylogging, screen capture, and data exfiltration capabilities.

Recent campaigns have shown AsyncRAT operators abusing trusted cloud infrastructure such as Cloudflare’s free-tier services and TryCloudflare tunnels to host payload delivery servers, making detection significantly harder for conventional security tools.

Top 10 Malware Threats of the Week

Remcos RAT recorded the largest single gain among the top three, rising by 59 samples to reach 196 total uploads, underscoring an intensifying wave of espionage and surveillance-driven campaigns.

Originally marketed as a legitimate remote administration tool, Remcos has evolved into a favored espionage and credential-theft platform for both cybercriminals and initial access brokers.

Newer variants observed in early 2026 have shifted toward real-time surveillance, streaming live webcam footage and transmitting keystrokes instantly rather than waiting to exfiltrate stored data, effectively turning infected machines into live monitoring feeds for attackers.

Xworm followed closely with 183 uploads and a gain of 16, continuing its reputation as a highly adaptable, modular RAT sold through malware-as-a-service channels.

Recent Xworm campaigns have leveraged multiple file formats and scripting languages, including PowerShell, VBS, HTA, and Office macro exploits such as CVE-2018-0802, to stage payloads and evade endpoint defenses.

Beyond typical RAT functions like keylogging and webcam access, newer Xworm builds also incorporate destructive capabilities to deploy stealthy infostealer payloads, file encryption, and distributed denial-of-service (DDoS) features.

AgentTesla ranked fourth with 172 uploads and a sharp 51-sample increase, reaffirming its long-standing role as one of the most prolific credential-stealing Trojans in circulation.

Close behind, Stealc posted the single largest weekly jump of the entire list, up 67 samples to reach 159 total uploads, followed by Vidar at 157 with a smaller rise of six.

Both are widely used information stealers designed to harvest browser credentials, cryptocurrency wallet data, and session tokens from infected endpoints.

As detailed in the weekly threat metrics published in the ANY.RUN malware analysis, DonutLoader climbed 16 samples to 140 uploads, reflecting its growing role as a delivery mechanism for secondary payloads, while Lumma stealer rose 27 samples to 126. Formbook rounded out the mid-tier with 97 uploads, up 21 for the week.

Snake was the only family among the top ten to decline, dropping two samples to close the week at 93 total uploads, a modest but notable exception amid an otherwise broad surge across nearly every major malware category.

Security teams are advised to prioritize detection rules for phishing-based delivery chains, monitor for anomalous PowerShell and HTA execution, and flag traffic to known Remcos, AsyncRAT, and Xworm command-and-control infrastructure to blunt the impact of this activity spike.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post Top 10 Malware Threats of the Week – AsyncRAT, Remcos, and Xworm Lead the Surge appeared first on Cyber Security News.

LLMs leave statistical fingerprints in the passwords they generate. We built a 100-year-old model to find them and detected 28,000 in the wild.

The post The Bot Left a Fingerprint: Detecting and Attributing LLM-Generated Passwords appeared first on Security Boulevard.

Vercel's Context.ai breach exposed environment variables that weren't marked sensitive. Learn how to pull and scan your secrets with GitGuardian.

The post Vercel April 2026 Incident: Non-Sensitive Environment Variables Need Investigation Too appeared first on Security Boulevard.

Recent supply chain attacks stayed live for hours. Automation tools silently merged their malware in minutes. Read how upgrade bots and AI agents became the insider threat.

The post Renovate & Dependabot: The New Malware Delivery System appeared first on Security Boulevard.

GitGuardian’s 5th State of Secrets Sprawl report is here. In this blog, we unpack the key findings behind the 2026 edition, from AI-driven leak growth to the remediation gaps security teams can’t ignore.

The post The State of Secrets Sprawl 2026: AI-Service Leaks Surge 81% and 29M Secrets Hit Public GitHub appeared first on Security Boulevard.

GitGuardian partnered with Google to answer: what happens when private keys leak? Using Certificate Transparency, we mapped about 1M leaked keys to 140k certificates. Result: 2,622 were valid as of September 2025, exposing major organizations. Our disclosure campaign achieved 97% remediation.

The post 2,622 Valid Certificates Exposed: A Google-GitGuardian Study Maps Private Key Leaks to Real-World Risk appeared first on Security Boulevard.

Starkiller is a new SaaS-style phishing framework that runs real brand websites inside headless Chrome containers, acting as a live reverse proxy to steal credentials, session tokens, and MFA-protected accounts while evading traditional detection.

The post Starkiller Phishing Framework Bypasses Defenses with Reverse Proxies, Takes an SaaS Approach  appeared first on Security Boulevard.