Malware

Malware activity averaged 39,341 hits per firewall in the first half of 2026, giving financial services the second-highest per-device malware intensity of any industry, behind only healthcare.

Ten ransomware families were active against the financial services sector in the first half of 2026, including REvil (Sodinokibi) and Prometheus.

1 in 7 of Austrailian SME owners or managers reported malware.

11% of the top 100 vendors most commonly used by universities currently show evidence of active infostealer malware infections.

33.9% of Australian SME owners or managers reported experiencing malware.

IT and security professionals rate attackers using AI to generate self-mutating malware as a high or extreme risk at 55.9%, employees leaking sensitive data into public LLMs at 53.5%, AI-driven evasion techniques at 52.5%, and deepfakes or voice cloning used in fraud or BEC at 51.9%.

67.3% of the 832 malicious accounts banned between March 2025 and March 2026 used AI to write malware.

495 malicious AI models were identified on Hugging Face.

56 malicious extensions were identified on OpenVSX.

969 malicious AI agent skills were identified carrying high-impact payloads.

33% of CIOs identify malware and ransomware as dominant threats.

Credential-stealer infections were dominated by RedLine with 911,968 infections (50.80%), Lumma with 499,784 infections (27.84%), and Vidar with 236,778 infections (13.19%).

Over a quarter of CIOs report AI as a significant source of risk, placing it on par with malware, ransomware and phishing.

11.01% of organizations have active malicious packages embedded in production environments.

BRICKSTORM achieved dwell times of nearly 400 days.

Threat actors deployed more than 147,000 malicious domains, nearly 58,000 malware files, and actively exploited 549 vulnerabilities in 2025.

Malware hidden in public model and code repositories accounts for 35% of AI-related breaches.

Nearly half of the active malware families have financial extortion capabilities, including ransomware that can encrypt files on the device.

Over 11.1 million machines were infected with infostealers in 2025.

Thirty-four active malware families targeted 1,243 financial apps across 90 countries.