Malware in 2026: A Practitioner's Field Guide to the Types You Will Actually See

By Manny Fernandez

November 10, 2026

Malware in 2026: A Practitioner’s Field Guide to the Types You Will Actually See

Infostealers, ransomware, loaders, RATs, worms, botnets, wipers, EDR killers, mobile NFC relay, and the first LLM-in-the-loop families. What each one does, how it shows up today, and the FortiGate controls that break it.

Executive Summary

Objective: give you a current, practitioner-level map of the malware categories hitting networks in 2026, the named families driving each one, and the specific controls that interrupt them.

Target audience: network and security engineers, SOC analysts, and IT leads who need to translate threat-report headlines into policy, sensors, and detections.

The short version: the textbook categories (virus, worm, Trojan) still exist, but they are no longer the useful way to think. Modern malware is specialized by role in an intrusion chain. One family steals the credentials, another loads the next stage, another keeps remote control, and the final payload monetizes or destroys. The industry data backs this up. The Verizon 2026 DBIR found that 73% of ransomware victims had an infostealer infection or credential leak in the year before the attack, and CrowdStrike reports that 82% of its 2025 detections were malware-free, meaning the attacker was already operating with valid credentials. If you only hunt for the ransomware binary, you are hunting for the last step.

Why Role Beats Category

Classic taxonomy describes how malware spreads (a virus needs a host file, a worm self-propagates, a Trojan pretends to be legitimate). That still matters for detection, but it tells you very little about what the attacker wants next. The diagram below groups today’s families by the job they do in the chain. Read it left to right: each stage hands off to the next, and every hand-off is a place you can cut the chain.

Figure 1. Malware grouped by its job in the intrusion chain. Every arrow is a control point.

Keep that framing in mind as you read the field guide. Each entry below lists what the malware is, how it is showing up right now, the families you will see in reports and logs, the first signal it usually gives off, and the controls that break it.

The Field Guide

1. Infostealers

What it is	Commodity malware that grabs saved browser passwords, session cookies, MFA tokens, crypto wallets, VPN and SSH configs, then ships the bundle (a “log”) to an operator who sells it or uses it. Sold as malware-as-a-service on a subscription.
How it shows up in 2026	The dominant category and the front door to almost everything else. IBM X-Force counted more than 16 million devices infected by infostealers such as Lumma, Acreed, and Vidar in 2025, and Recorded Future indexed 1.95 billion malware-sourced credentials that same year. Delivery has shifted heavily to ClickFix fake-CAPTCHA pages that trick users into pasting a command into the Run dialog or Terminal. macOS is firmly in scope through AMOS (Atomic Stealer).
Families to know	LummaC2, StealC, Vidar, ACRStealer, RisePro, SnakeStealer, Agent Tesla, AMOS (macOS). RedLine declined after Operation Magnus in October 2024, but its stolen logs still circulate.
First signal	User reports a “verify you are human” page that asked them to press Win+R. Unusual `powershell.exe` or `mshta.exe` child of `explorer.exe`. New sessions to your SaaS tenant from an unfamiliar ASN using a valid cookie.
Controls that break it	Phishing-resistant MFA (FIDO2) so stolen session cookies are worth less. Short SaaS session lifetimes and token binding. DNS filtering with botnet C2 blocking. Block or alert on Run-dialog PowerShell via EDR. Disable browser password storage by policy and move users to a managed password manager.

2. Ransomware and Data Extortion

What it is	Malware that encrypts files and/or steals data, then extorts the victim for payment. Run as Ransomware-as-a-Service (RaaS): core developers build the locker and leak site, affiliates do the intrusions and split proceeds.
How it shows up in 2026	Volume keeps climbing. Black Kite tracked 7,551 publicly disclosed victims from April 2025 to March 2026, up 24.9% year over year, with Qilin alone claiming 1,358. Two shifts matter. First, encryptionless extortion: with only about 28% of victims paying in 2025, groups like ShinyHunters skip the locker entirely, steal data through identity and SaaS access, and extort on publication alone. Second, Kaspersky reports newer families adopting post-quantum ciphers for their encryption routines.
Families to know	Qilin, Akira, The Gentlemen, Cl0p, Medusa, Interlock, Gunra, ShinyHunters (extortion-only).
First signal	Mass file renames, deletion of Volume Shadow Copies, backup agents stopped, sudden large outbound transfers to cloud storage or VPS ranges hours or days before encryption.
Controls that break it	Immutable, offline-tested backups. Egress default-deny on servers. Segmentation so one compromised host cannot reach every file share. Alert on `vssadmin delete shadows` and `wbadmin`. Watch outbound volume baselines (exfiltration precedes encryption).

3. Loaders and Droppers

What it is	Small first-stage malware whose only job is to land on the host, check the environment, and pull down the real payload. Initial access brokers rent loader “installs” to ransomware affiliates.
How it shows up in 2026	Loaders are increasingly blended into other families. Researchers note that infostealers now commonly ship with loader or backdoor functionality built in, so the line between “stealer” and “loader” is blurring. Delivery rides malvertising, fake software updates, SEO-poisoned download sites, and ClickFix.
Families to know	Raspberry Robin, Bumblebee, PrivateLoader, SmokeLoader, plus the loader modules inside Vidar and Lumma.
First signal	A newly written executable in `%AppData%` or `%Temp%` that beacons within seconds, downloads a second file, and spawns it. Odd parent-child chains such as `msiexec` launching `rundll32`.
Controls that break it	Sandbox (FortiSandbox) for unknown executables and installers. Block newly registered domains at DNS. Application allow-listing on servers. Remove local admin from standard users.

4. Remote Access Trojans (RATs) and Backdoors

What it is	Malware that gives an operator interactive control: shell, file transfer, keylogging, screen capture, and pivoting. A backdoor is the long-term persistence version, often used by state actors.
How it shows up in 2026	Commodity RATs remain among the most detected families in quarterly reports, and on Android, SpyNote is now the remote-control half of the NFC relay fraud chain covered below.
Families to know	XWorm, AsyncRAT, Remcos, PlugX, SpyNote (Android). Many intrusions also abuse legitimate RMM tools (AnyDesk, ScreenConnect) in the same role.
First signal	Steady, low-volume beaconing at a fixed interval to a single external host. RMM software installed outside your sanctioned tool list.
Controls that break it	IPS botnet C2 detection. Application Control policy that blocks unsanctioned remote-access apps. Beacon analytics in your SIEM (same destination, same interval, small consistent payloads).

5. Trojans (the umbrella)

What it is	Any malware that disguises itself as something legitimate to get executed. Most of the categories above are delivered as Trojans, which is why Trojans still top raw detection counts.
How it shows up in 2026	Point Wild’s Q2 2026 analysis put Trojans at 45.4% of detections, followed by infostealers at 20.9%. Treat “Trojan” as a delivery description, not a threat model: always ask what the Trojan actually installs.
Families to know	Fake installers for popular tools, cracked software, trojanized updates. In April 2026 attackers hijacked CPUID download links to serve malware in place of CPU-Z and HWMonitor.
First signal	A signed-looking installer from an unofficial mirror, or a legitimate site serving a hash that does not match the vendor’s published value.
Controls that break it	Antivirus with outbreak prevention plus sandboxing. Software sourcing policy (internal repository or vendor-verified sources only). Hash verification in your deployment workflow.

6. Worms, Including Software Supply-Chain Worms

What it is	Self-propagating malware that spreads without user action. The 2026 twist is worms that spread through developer ecosystems rather than network ports.
How it shows up in 2026	The Shai-Hulud family is the defining example. It steals npm, GitHub, AWS, Kubernetes, and Vault credentials, then uses stolen publish tokens to republish itself into every package the victim maintains. TeamPCP open-sourced the worm on May 13, 2026, and copycats appeared within days. On August 4, 2026, the ChainDrop wave compromised a maintainer account and pushed malicious releases through legitimate GitHub Actions, so the packages carried valid SLSA provenance, then expanded to more than 430 packages within hours. It also plants persistence hooks in AI coding assistant configs.
Families to know	Shai-Hulud, Mini Shai-Hulud, ChainDrop (Shai-Hulud 2.0), plus classic network worms in the Mirai lineage.
First signal	Unexpected new versions of your internal or dependency packages, `postinstall` scripts making outbound calls, developer tokens used from CI runners you do not own.
Controls that break it	Pin dependencies and use lockfiles. Disable install scripts by default (`npm config set ignore-scripts true`) and allow them per package. Short-lived, scoped publish tokens. Egress control on CI runners. Provenance is necessary but no longer sufficient on its own.

7. Botnets and IoT Malware

What it is	Malware that enrolls devices into an operator-controlled fleet for DDoS, proxying, spam, or credential stuffing. IoT and edge devices are favored because they are rarely patched or monitored.
How it shows up in 2026	Aisuru, a Mirai-derived (TurboMirai-class) botnet, reset the scale of the problem. Cloudflare recorded it peaking at 29.7 Tbps in October 2025, and Microsoft mitigated a 15.72 Tbps attack from more than 500,000 source IPs. Its bots include routers, cameras, cloud VMs, and even security appliances. A growing secondary business is residential proxy resale, where your compromised devices carry other criminals’ traffic.
Families to know	Aisuru, Mirai variants, residential-proxy botnets.
First signal	IoT devices making outbound connections to anything other than their vendor cloud. Sudden upstream bandwidth spikes from a camera VLAN.
Controls that break it	Put IoT on its own VLAN with an explicit outbound allow-list. Change default credentials, disable UPnP, patch edge firmware. Upstream DDoS mitigation sized for multi-terabit events.

8. Wipers

What it is	Destructive malware that deletes or corrupts data, overwrites disks, or destroys boot records, with no realistic recovery path. Some wipers masquerade as ransomware.
How it shows up in 2026	Wipers track geopolitics. In March 2026 the Iran-linked Handala group claimed to have wiped more than 200,000 devices at Stryker during the US-Israel and Iran cyber exchanges. SecurityWeek also reported Lotus Wiper against Venezuela’s energy sector and GigaWiper, a backdoor that bundles wiping and ransomware encryption. The UAE Cyber Security Council issued an active multi-sector wiper advisory in April 2026.
Families to know	Handala tooling, Lotus Wiper, GigaWiper, PathWiper, and ransomware with wiper modes such as Anubis.
First signal	Mass deletes, MBR or partition table writes, backup catalogs being purged, and management platforms (MDM, hypervisor consoles) used to push destructive commands at scale.
Controls that break it	Offline and immutable backups (wipers target online backups first). MFA and approval workflows on device-management and hypervisor consoles, since the Stryker-style pattern abuses admin tooling. Segment management planes.

9. Rootkits, Bootkits, and EDR Killers

What it is	Code that hides malware or disables defenses at the kernel or firmware level. The most active form in 2026 is the EDR killer, usually built on BYOVD (Bring Your Own Vulnerable Driver): load a legitimately signed but vulnerable driver, then use its kernel access to terminate security agents.
How it shows up in 2026	Ransomware crews now treat EDR killers as core product. ESET’s research on The Gentlemen RaaS describes GentleKiller, a standardized suite handed to affiliates that targets more than 400 security processes from 48 vendors, and the group weaponizes new BYOVD proofs-of-concept within days of publication. Symantec documented Reynolds ransomware, which embeds the BYOVD component directly in the encryptor to close the gap between blinding the EDR and encrypting.
Families to know	GentleKiller, EDRKillShifter-style tools, Reynolds, plus abused drivers from anti-cheat and legacy security products.
First signal	EDR agents going silent on several hosts at once. A new kernel driver service created from a user-writable path.
Controls that break it	Enable Microsoft’s vulnerable driver blocklist and HVCI (memory integrity). Alert on new driver service creation. Treat “agent stopped reporting” as a high-severity alert, not a hygiene ticket. Network-layer controls (IPS, DNS filtering) keep working when the endpoint agent is blinded.

10. Mobile Banking Malware and NFC Relay

What it is	Android malware that steals banking credentials, abuses Accessibility services to drive apps, or relays the victim’s contactless card in real time to a criminal at a payment terminal or ATM (“ghost tapping”).
How it shows up in 2026	Kaspersky blocked 35,600 NFC-based Android attacks in January to April 2026, a 188% increase over the same period in 2025. In August 2026 Group-IB documented WindRelay, paired with the SpyNote RAT: a fraudster calls posing as the bank, talks the victim into installing an app, then uses SpyNote to silently install the NFC relay and cash out. NFC relay kits are now sold as malware-as-a-service.
Families to know	WindRelay, NGate, SuperCard X, NFCShare, RelayNFC, DevilNFC, Manic.
First signal	A “bank” calling to request an app install. A banking app sideloaded from a link or GitHub rather than Google Play.
Controls that break it	MDM policy blocking sideloading on corporate devices. Keep Play Protect on. User awareness that banks do not ask you to install apps or tap your card on your phone.

11. Fileless and Living-off-the-Land Malware

What it is	Malware that runs mostly in memory or through built-in tools (PowerShell, WMI, `mshta`, `rundll32`, `certutil`) so there is little or nothing on disk for signature AV to catch.
How it shows up in 2026	This is the technique layer under most of the categories above, and it is why CrowdStrike can report that 82% of detections were malware-free. ClickFix is a perfect example: the “malware” is a PowerShell one-liner the user pastes themselves.
Families to know	Not a family, a technique. Seen in Lumma, StealC, and nearly every ransomware intrusion.
First signal	Encoded PowerShell command lines, `mshta` reaching the internet, `certutil -urlcache` downloads.
Controls that break it	PowerShell Constrained Language Mode and script block logging. Attack Surface Reduction rules. EDR behavioral detection. Block internet access for `mshta` and `certutil` at the endpoint firewall.

12. AI-Enabled Malware (LLM-in-the-Loop)

What it is	Malware that calls a large language model at runtime to generate commands, rewrite its own code, or decide what to steal. It is early, but no longer theoretical.
How it shows up in 2026	Google’s Threat Intelligence Group reported the first families in November 2025. PROMPTFLUX is a VBScript dropper whose “Thinking Robot” module asks Gemini to rewrite its own source to evade AV, with one variant regenerating hourly. PROMPTSTEAL, used by APT28 against Ukraine, queries Qwen2.5-Coder to generate one-line Windows recon and collection commands, and GTIG called it the first LLM-querying malware seen in live operations. PROMPTLOCK is a proof-of-concept ransomware that has an LLM generate per-victim Lua scripts for discovery, exfiltration, and encryption. QUIETVAULT steals GitHub and npm tokens and uses local AI tools to hunt for more secrets.
Families to know	PROMPTFLUX, PROMPTSTEAL (LameHug), PROMPTLOCK, QUIETVAULT, FRUITSHELL.
First signal	A non-developer workstation or a server calling an LLM API endpoint. A new command executing immediately after an LLM API response.
Controls that break it	The weakness is the dependency: this malware needs a reachable model. Inventory sanctioned AI endpoints, deny LLM API destinations from servers and OT, and log them everywhere else. Keep behavioral detection on, since generated code changes but the actions (recon, staging, exfiltration) do not.

Still Around: Spyware, Adware, and Cryptominers

These rarely make headlines, but they still matter. Spyware and stalkerware compromise individual privacy, adware is a common delivery vehicle for loaders, and cryptominers on cloud workloads quietly run up compute bills. Treat any of them as proof that the initial-access path is open, and close it.

Quick Reference

Type	Primary goal	Typical delivery	First signal
Infostealer	Credentials, cookies, wallets	ClickFix, malvertising, cracks	Odd Run-dialog PowerShell; new-ASN SaaS sessions
Ransomware / extortion	Payment via encryption or leak	Stolen creds, VPN/edge exploits	Shadow copy deletion; outbound volume spike
Loader	Deliver next stage	Fake updates, SEO poisoning	New binary beacons then downloads
RAT / backdoor	Interactive control	Phishing, loaders, RMM abuse	Fixed-interval beaconing
Supply-chain worm	Developer and cloud secrets	Compromised packages	Unexpected package versions; postinstall egress
Botnet / IoT	DDoS, proxy resale	Default creds, unpatched edge	IoT talking beyond vendor cloud
Wiper	Destruction	Admin tooling abuse, phishing	Mass deletes; MDM mass commands
EDR killer / rootkit	Blind defenses	Vulnerable signed drivers	Agents go silent together
Mobile NFC relay	Card cash-out	Vishing plus sideloaded app	“Bank” asks for app install
AI-enabled	Adaptive evasion, recon	Dropper or post-exploitation	LLM API calls from odd hosts

Defender Playbook: FortiGate Controls Mapped to the Chain

Network controls do not replace EDR, but they keep working when the endpoint is blinded by an EDR killer, and they see every device, including the IoT and unmanaged hosts that never get an agent. The configs below use the InfoSecMonkey lab convention: 10.0.0.0/16 for internal LANs, with servers on 10.0.20.0/24. Adjust names to your environment.

Step 1: Block Botnet and C2 Domains at DNS

Goal: cut infostealer exfiltration, loader downloads, and RAT beacons at name resolution, before a socket ever opens.

Action: enable FortiGuard botnet C&C domain blocking and log every query so you have DNS history for hunting.

config dnsfilter profile
    edit "dns-malware-block"
        set block-botnet enable
        set log-all-domain enable
        set sdns-domain-log enable
    next
end

GUI verification: Security Profiles > DNS Filter > dns-malware-block. Block DNS requests to known botnet C&C should be on.

Step 2: Detect Botnet Connections by IP in IPS

Goal: catch C2 that skips DNS and connects straight to an IP, which is common for RATs and IoT bots.

config ips sensor
    edit "ips-malware"
        set scan-botnet-connections block
        config entries
            edit 1
                set severity high critical
                set status enable
                set action block
            next
        end
    next
end

Step 3: Antivirus With Outbreak Prevention

Goal: stop known droppers and Trojans, and use FortiGuard’s outbreak prevention hash feed to catch new variants before full signatures ship. Pair this with FortiSandbox for unknown files if you have it.

config antivirus profile
    edit "av-strict"
        config http
            set av-scan block
            set outbreak-prevention block
        end
        config ftp
            set av-scan block
            set outbreak-prevention block
        end
        config smtp
            set av-scan block
            set outbreak-prevention block
        end
    next
end

Gotcha: AV on HTTPS only sees content you can decrypt. Without a deep-inspection SSL/SSH profile on the policy, the AV engine is scanning ciphertext. Exempt banking, healthcare, and pinned apps by category, but inspect the rest.

Step 4: Deny LLM API Egress From Servers

Goal: break the runtime dependency that PROMPTFLUX-style malware needs. Servers have no business calling public model APIs unless you sanctioned it.

config firewall address
    edit "llm-gemini-api"
        set type fqdn
        set fqdn "generativelanguage.googleapis.com"
    next
end
config firewall addrgrp
    edit "grp-unsanctioned-llm-api"
        set member "llm-gemini-api"
    next
end
config firewall address
    edit "net-servers"
        set subnet 10.0.20.0 255.255.255.0
    next
end
config firewall policy
    edit 0
        set name "deny-servers-to-llm-api"
        set srcintf "srv"
        set dstintf "wan1"
        set srcaddr "net-servers"
        set dstaddr "grp-unsanctioned-llm-api"
        set action deny
        set schedule "always"
        set service "ALL"
        set logtraffic all
    next
end

Add the other model endpoints you do not sanction to the group, then move the policy above your general server outbound rule. On user segments, log these destinations instead of denying them, and review which hosts call them.

Step 5: Apply the Profiles to Outbound Policy

config firewall policy
    edit <policy-id>
        set utm-status enable
        set ssl-ssh-profile "deep-inspection"
        set av-profile "av-strict"
        set ips-sensor "ips-malware"
        set dnsfilter-profile "dns-malware-block"
        set logtraffic all
    next
end

Step 6: Contain IoT and Isolate Management Planes

Put cameras, printers, and building systems on their own interface with an outbound allow-list to their vendor clouds only. That single policy defeats most botnet enrollment and residential-proxy abuse. Do the same in reverse for management: MDM, hypervisor, and backup consoles should be reachable only from a privileged-access segment, because wipers and ransomware operators go straight for those consoles.

Verification and Validation

Confirm the FortiGuard databases these profiles depend on are current. Look for the botnet IP and botnet domain entries and recent update dates:

diagnose autoupdate versions

Expected success output: the AV engine, AV definitions, IPS definitions, and botnet database entries each show a recent Last Update and a Result of Updates Installed or No Updates. A date weeks old means your FortiGuard connection or license needs attention.

Then generate safe test traffic. Download the EICAR test file over HTTPS from a lab client: with deep inspection on, the AV log should show it blocked. Look up a FortiGuard test domain listed in the DNS filter documentation and confirm a block entry in Log & Report > Security Events > DNS Query.

Troubleshooting and Gotchas

AV logs are empty for web traffic. The policy is using certificate-inspection or no SSL profile. Switch to deep-inspection and push the FortiGate CA to clients.
DNS filter never fires. Clients are using DoH or an external resolver. Block outbound TCP/UDP 53 and 853 except from your resolvers, and use Application Control to block DoH providers so clients fall back to the FortiGate-inspected path.
The LLM deny policy shows no hits. FQDN objects resolve through the FortiGate’s own DNS. Confirm the object resolved with diagnose firewall fqdn list, and confirm the policy sits above the broader allow rule.
Agents keep going offline on a few hosts. Do not close it as a connectivity ticket. That pattern is the classic EDR-killer signal. Check for new driver services and correlate with outbound traffic from the same hosts.

The Bottom Line

Malware in 2026 is a supply chain of specialists. The infostealer you ignore on Monday becomes the ransomware incident on Friday, and the worm in your developer’s node_modules becomes the cloud key leak next week. Map your controls to the roles, not just the names: stop credential theft, cut the C2 hand-off, assume the endpoint agent can be blinded, and make sure the impact stage hits immutable backups and segmented management planes. No fluff. Just the config that works.