Malware is evolving rapidly, driven by advances in AI and changes in computing infrastructures.Security professionals must continuously educate themselves on these trends to defend against increasingly sophisticated threats.The traditional game of cat and mouse between security attackers and defenders has got fiercer with fresh techniques evolving and older less effective approaches falling out of fashion.Here is a look at what’s heating up in the world of malware — and what’s cooling off.Infostealers commoditizing initial accessInfostealers have experienced huge growth in the past 18 months, with malware such as Lumma Stealer, StealC, and RisePro now responsible for 75% of all stolen credentials, according to cybersecurity vendor Immersive.Infostealers steal browser cookies, VPN credentials, multi-factor authentication (MFA) tokens, crypto wallet data, and more. Cybercriminals sell the data that infostealers grab through dark web markets, giving attackers easy access to corporate systems.“This shift commoditizes initial access, enabling nation-state goals through simple transactions rather than complex attacks,” says Ben McCarthy, lead cyber security engineer at Immersive.Malicious packages targeting developer environmentsThreat actors are systematically compromising the software supply chain by embedding malicious code within legitimate development tools, libraries, and frameworks that organizations use to build applications.“These supply chain attacks exploit the trust between developers and package repositories,” Immersive’s McCarthy tells CSO. “Malicious packages often mimic legitimate ones while running harmful code, evading standard code reviews.”Popular software development ecosystems such as NPM, PyPI, and AI platforms like HuggingFace are frequent targets of malicious actors seeking to seed compromised packages in software developers’ toolchains.Attackers continued to innovate in 2026 when targeting the software supply chain as a vector for malware delivery. For example, the Shai-Hulud attacks involved self-propagating malware that stole CI/CD secrets and hijacked GitHub Actions OIDC tokens to publish malicious package versions through victims’ own release pipelines.Similar tactics were in play in other attacks.“In the Axios compromise, attackers targeted the lead maintainer’s credentials and inserted a malicious dependency into legitimate software releases,” says Lindsey O’Donnell-Welch, principal technical writer at managed detection and response firm Huntress. “This led to downstream dependencies downloading remote-access malware tailored to the operating system.”Ransomware becoming more targeted and sophisticatedThe ransomware landscape shifted dramatically after law enforcement cracked down on major groups like LockBit.Modern ransomware threat actors such as RansomHub and Akira now favor smaller, highly targeted attacks, using ransomware as a final step after full infiltration and data exfiltration. This marks a move from broad, opportunistic strikes to focused, high-value campaigns.“These targeted approaches show threat actors’ growing insight into specific vulnerabilities and their readiness to invest heavily in reconnaissance and tailored attack development,” Immersive’s McCarthy comments.These groups use advanced evasion techniques such as living-off-the-land (LOTL) tactics and legitimate admin tools to stay hidden. They’re also shifting from file encryption to data theft and extortion, threatening public leaks to pressure victims.“There’s been a notable uptick in the use of cloud-based services and remote management platforms as part of ransomware toolchains,” says Jamie Moles, senior technical marketing manager at network detection and response provider ExtraHop. “This aligns with a broader trend: Rather than relying solely on traditional malware payloads, adversaries are increasingly shifting toward abusing trusted platforms and ‘living-off-the-land’ techniques.”Healthcare remains a top target of ransomware attacks, while critical infrastructure faces increasing threats as attackers exploit the urgency that prompts quick ransom payments.Malware adopting social engineering techniquesCybercriminals are increasingly adopting ClickFix as a malware delivery method in attacks that rely on social engineering techniques to successfully infect end-user devices.ClickFix tricks users into executing malicious code — usually a PowerShell script — on their own systems, taking advantage of growing user fatigue in having to jump through online hoops to ‘prove you’re human.’By hijacking trust in familiar CAPTCHA processes, threat actors are getting users to actively participate in their own compromise — copying and pasting malicious commands into their systems under the guise of simple verification.“We’ve seen this technique gain serious traction across phishing sites, compromised webpages, and social engineering campaigns,” says Jim Walter, senior threat researcher at SentinelLABS. “It’s simple, effective, and increasingly common.”CISOs need to be wary of the threat because it bypasses many traditional detection methods by relying on human behavior rather than system vulnerabilities.“Raising awareness, hardening endpoint execution policies, and deploying behavioral detection tools are essential to countering this wave of malware delivery,” Walter advises.Threat actors continue to bring new flavors of ClickFix into play in 2026.For example, Huntress logged a ClickFix lure in April dressed up as a free image-editing tool, which then led to a loader called CastleLoader before the attack chain dropped NetSupport RAT and a custom .NET stealer.“The end goal was to steal browser credentials, wallet extension data, and Telegram session files,” according to Huntress’ O’Donnell-Welch.Polymorphic malware evading detection mechanismsPolymorphic malware automatically modifies its code each time it replicates or infects a new system, making it difficult for signature-based detection methods to identify it.This type of malware is challenging for antivirus software to detect and for security researchers to analyze.Alex Hinchliffe, principal threat researcher at Unit 42, the threat intelligence and incident response arm at Palo Alto Networks, says, “Very basic or specific detection mechanisms, such as hash-based scanners, are thwarted by polymorphism, but it’s worth noting that each time a malicious program is compiled — e.g., into an executable — it will yield a new unique fingerprint or hash. Add to this the plethora of free and commercially available compressor, packer, and protector tools, which can be applied to a compiled program, and the ‘same’ program will yield yet more variations and permutations of the same fingerprint.”Polymorphic malware also often uses encryption to hide its payload, further complicating detection and analysis.AI ‘flattening’ the once diverse malware development ecosystemThe malware ecosystem is consolidating and shrinking partly due to greater use of AI.“There isn’t much of a necessity anymore for exploit kit developers, loaders, and feature-rich malware implants,” says Adam Brown, principal threat intelligence analyst at Huntress.What once was a diverse and federated ecosystem of malware developers and service providers has been “flattened with the introduction of AI, and the business efficiency of smash-and-grab intrusion techniques”, Brown says.Threat actors frequently use trial accounts for their tooling (e.g., ScreenConnect) and cover their command and control (C2) and exfiltration routes under Cloudflare accounts.“Free-cloud hosting is ubiquitous, negating the need and cost of bullet-proof hosters,” Brown adds. “As long as defenses are disabled prior, free and commercial toolsets — Cobalt Strike, Meterpreter, Bloodhound, et al — work just as well.”In addition, cybercriminal syndicates are increasingly forgoing investment in and development of fully featured trojans, exploit kits, and even dedicated hosting as part of a ruthless business-like optimization of cybercrime activity.“It is far more efficient for them [cybercrime syndicates] to disable defenses using legitimate executables — signed system drivers, remote management software, etc. — deploy easily coded info-stealers, leverage legitimate and ubiquitous tooling to laterally move, and execute a network-wide encryption of enterprise assets,” Brown explains.AI is speeding up existing attacksAlthough AI is yet to displace traditional attack methods, a range of security vendors report that attackers are using AI to make existing techniques faster and more convincing, while also allowing them to operate at greater scale.“It [AI] can help write phishing messages and automate reconnaissance, while also supporting faster vulnerability discovery and more realistic impersonation attempts,” says Patricia Leppert, team manager of customer trust and security at TeamViewer.But attackers are also using AI to build malware and related tooling.eSentire Threat Research Unit reports logging signs of AI-assisted development by attackers ranging from ransomware affiliates to a North Korean cyberespionage group.“Attackers use large language models (LLMs) such as ChatGPT, Claude, and DeepSeek to write loaders, droppers, admin panels and scripts, to convert code between languages, and to write social-engineering text,” says Spence Hutchinson, senior manager of intelligence research at eSentire. “They get past the models’ safeguards through jailbreaking, or through stolen and resold accounts.”Attackers adopting modern development techniquesMalware developers are also using modern software development practices. For example, security vendor Barracuda reports a growing use of modern programming languages such as Rust and Go in malware, especially ransomware binaries.“These languages allow developers to build malware that is more portable and easier to adapt across operating systems,” explains Christine Barry, senior chief cybersecurity storyteller and content manager for the office of the CTO at Barracuda. “Rather than maintaining separate malware families for Windows, Linux, and virtualization environments, threat actors can support multiple platforms from a common code base.”Agentic AI enters the frayAttackers are already using generative AI to create phishing emails, write malicious code, and accelerate social-engineering attacks. But agentic AI will push their capabilities further by combining LLMs with tools, memory, and decision-making capabilities that enable a malicious system to plan actions, adapt to obstacles, and pursue objectives autonomously.JadePuffer offers a recent example of such an agentic AI attack.“This attack conducted reconnaissance, adapted to changing conditions, harvested credentials, moved through the target environment, and carried out destructive actions with limited evidence of human interaction or control,” Barracuda’s Barry says. “Researchers also observed JadePuffer modifying its behavior when it encountered problems, allowing the attack to adapt to conditions that might interrupt a scripted attack.”Depreciated malware techniquesSome noticeable trends reflect a “downturn” for malware and hacking techniques that have fallen out of fashion, mainly because their effectiveness has decreased due to advances in security defenses.For example, threat actors rely more on legitimate admin tools — such as Sysinternals Suite and living-off-the-land binaries (LOLBins) — for evasion and persistence, and less on malicious executables.“On the hacking tool front, we observed a decrease in the use of more comprehensive tool suites like Cobalt Strike and Sliver,” says O’Donnell-Welch of Huntress. “However, threat actors continue to use specialized tools like Mimikatz and CrackMapExec for functionalities like password sniffing, memory dumping, privilege escalation, and lateral movement.”Other once popular techniques that have fallen out of favor include:Network worms, such as Conficker, because modern networks now feature segmentation, automated patching, and strong endpoint defenses, all of which limit worm propagationTraditional botnetsExploit kits, which were once a prevalent method for delivering malware through web-based attacks by scanning users’ systems for known vulnerabilities in software such as Adobe Flash, Java, or Internet Explorer, and then exploiting those weaknesses to install malwareOffice macrosUSB-based malware