Global malware activity climbed sharply over the past week, with remote access trojans (RATs), information stealers, and loaders all posting significant week-over-week gains, according to threat sample uploads tracked by ANY.RUN.

AsyncRAT topped the chart with 211 uploads, edging out Remcos at 196 and Xworm at 183. This trend signals that RAT-based intrusions remain the dominant tactic for cybercriminals seeking persistent, hands-on-keyboard access to compromised Windows systems.

AsyncRAT held the number one position with 211 total uploads and a modest weekly increase of two samples, reflecting its status as one of the most consistently deployed .NET-based remote access trojans in the current threat landscape. The malware is typically delivered through phishing email attacks containing malicious attachments or links.

Once installed, it grants attackers full remote command execution, keylogging, screen capture, and data exfiltration capabilities.

Recent campaigns have shown AsyncRAT operators abusing trusted cloud infrastructure such as Cloudflare’s free-tier services and TryCloudflare tunnels to host payload delivery servers, making detection significantly harder for conventional security tools.

Top 10 Malware Threats of the Week

Remcos RAT recorded the largest single gain among the top three, rising by 59 samples to reach 196 total uploads, underscoring an intensifying wave of espionage and surveillance-driven campaigns.

Originally marketed as a legitimate remote administration tool, Remcos has evolved into a favored espionage and credential-theft platform for both cybercriminals and initial access brokers.

Newer variants observed in early 2026 have shifted toward real-time surveillance, streaming live webcam footage and transmitting keystrokes instantly rather than waiting to exfiltrate stored data, effectively turning infected machines into live monitoring feeds for attackers.

Xworm followed closely with 183 uploads and a gain of 16, continuing its reputation as a highly adaptable, modular RAT sold through malware-as-a-service channels.

Recent Xworm campaigns have leveraged multiple file formats and scripting languages, including PowerShell, VBS, HTA, and Office macro exploits such as CVE-2018-0802, to stage payloads and evade endpoint defenses.

Beyond typical RAT functions like keylogging and webcam access, newer Xworm builds also incorporate destructive capabilities to deploy stealthy infostealer payloads, file encryption, and distributed denial-of-service (DDoS) features.

AgentTesla ranked fourth with 172 uploads and a sharp 51-sample increase, reaffirming its long-standing role as one of the most prolific credential-stealing Trojans in circulation.

Close behind, Stealc posted the single largest weekly jump of the entire list, up 67 samples to reach 159 total uploads, followed by Vidar at 157 with a smaller rise of six.

Both are widely used information stealers designed to harvest browser credentials, cryptocurrency wallet data, and session tokens from infected endpoints.

As detailed in the weekly threat metrics published in the ANY.RUN malware analysis, DonutLoader climbed 16 samples to 140 uploads, reflecting its growing role as a delivery mechanism for secondary payloads, while Lumma stealer rose 27 samples to 126. Formbook rounded out the mid-tier with 97 uploads, up 21 for the week.

Snake was the only family among the top ten to decline, dropping two samples to close the week at 93 total uploads, a modest but notable exception amid an otherwise broad surge across nearly every major malware category.

Security teams are advised to prioritize detection rules for phishing-based delivery chains, monitor for anomalous PowerShell and HTA execution, and flag traffic to known Remcos, AsyncRAT, and Xworm command-and-control infrastructure to blunt the impact of this activity spike.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post Top 10 Malware Threats of the Week – AsyncRAT, Remcos, and Xworm Lead the Surge appeared first on Cyber Security News.

Unit 42 research details how attackers could exploit global name uniqueness in bucket hijacking to redirect cloud data streams across major CSPs.

The post The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration appeared first on Unit 42.

Unit 42 discovered a Vertex AI Python SDK vulnerability that allows remote code execution via bucket squatting. Read the article for more.

The post Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE appeared first on Unit 42.

Unit 42 research examines attack scenarios targeting cloud logging services. Learn how to defend against log manipulation and defense evasion.

The post Blinding the Watchmen: Abusing Cloud Logging Services for Defense Evasion and Visibility appeared first on Unit 42.

Open-source framework ROADtools is being misused by threat actors for cloud intrusions. Learn how to identify its malicious use.

The post Paved With Intent: ROADtools and Nation-State Tactics in the Cloud appeared first on Unit 42.

Unit 42 reveals how multi-agent AI systems can autonomously attack cloud environments. Learn critical insights and vital lessons for proactive security.

The post Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System appeared first on Unit 42.