October 20, 2026 12 min read

Q3 2026 Windows Cyber Threat & Malware Landscape Report

Alisha Kadam Lat61 Threat Intelligence Team

Executive Summary

The Q3 2026 Windows threat landscape continued to evolve toward multi-stage, evasive attack chains, with threat actors combining social engineering, trusted Windows components, scripting engines, encrypted payloads, and execution hijacking to deliver malware and evade security controls.

Trojans remained the dominant category, followed by Viruses, with the top five categories accounting for the large majority of the distribution. Virus volume was heavily concentrated in a single family, the Expiro file infector. Ransomware reached record monthly volumes, with manufacturing the most affected industry. Windows exploitation centred on on-premises Microsoft SharePoint Server, where several vulnerabilities were weaponised before patches were available, while supply-chain compromise stayed concentrated in the npm ecosystem.

The recurring theme across every category was abuse of legitimate functionality: signed binaries, scripting engines, trusted cloud services, and package registries, which limits the value of file-based detection and makes multi-stage behavioural analysis increasingly important.

1. Threat Landscape Overview

The Q3 2026 threat landscape remained dominated by Trojan-based threats, while Point Wild processed malware across multiple categories and attack stages during the quarter. The analysis highlights continued activity involving credential theft, phishing, persistence, remote access, and ransomware. Trojans accounted for the largest share at 48%, followed by Viruses at 16.5%. Phishing, Adware, and Infostealers contributed 7.5%, 6.5%, and 5.5%, respectively, while Backdoors, Downloaders, Worms, and Ransomware represented smaller but notable shares. Overall, the top five categories accounted for 84% of the distribution, highlighting the concentration of Q3 malware activity within a few major threat categories.

Figure 1. Q3 2026 Threat Category Distribution by Point Wild.

2. Point Wild Research Findings

Point Wild’s Q3 2026 research identified several malware families and infection chains that demonstrate the continued use of multi-stage delivery, legitimate system components, scripting engines, memory-based execution, and anti-analysis techniques.

2.1 AsyncRAT

Point Wild Threat Intelligence analyzed a multi-stage AsyncRAT infection chain delivered through an AutoIt-based execution mechanism. The attack begins with a socially engineered batch file that launches hidden PowerShell and reconstructs an encoded payload through multiple Base64 fragments and repeating-key XOR decoding.

During execution, the encrypted payload is decrypted and ultimately results in AsyncRAT execution within a Microsoft-signed Windows process. The chain demonstrates the abuse of legitimate signed binaries, layered encoding and encryption, fileless or memory-oriented execution, and anti-analysis techniques to reduce the visibility of the malware.

Point Wild’s analysis highlights how commodity RATs such as AsyncRAT can be delivered through increasingly complex multi-stage chains designed to bypass conventional static detection.

Stage 1	Stage 2	Stage 3	Stage 4	Stage 5
Invoice Details.bat	Hidden PowerShell	Base64 + XOR decoding	AutoIt + encrypted payload	AsyncRAT execution

Figure 2. Point Wild Threat Intelligence identified an AsyncRAT multi-stage infection chain.

2.2 AZALEA RAT

Point Wild researchers identified a multi-stage Windows infection chain in which a seemingly benign batch file was used to deliver AZALEA RAT. The chain leveraged legitimate .NET components, AppDomain Manager hijacking, trusted Windows utilities, and AES-256-CBC encryption to conceal and execute the final payload.

The infection chain also incorporated self-deletion and anti-analysis techniques, reducing the malware’s forensic footprint and making traditional file-based investigation more challenging. The findings demonstrate how attackers can combine legitimate system functionality with encrypted payloads and execution hijacking to deliver RAT malware while attempting to evade security controls.

Stage 1	Stage 2	Stage 3	Stage 4	Stage 5	Stage 6
Malicious BAT	Legitimate .NET	AppDomain Manager hijacking	Encrypted payload	AES-256-CBC	AZALEA RAT

Figure 3. Multi-stage AZALEA RAT delivery chain identified by Point Wild.

3. Virus Families Processed by Point Wild

Viruses ranked as the second-largest threat category in Q3 2026. However, the category was highly concentrated, with most of its detection volume attributed to a single family. The dataset spanned 341 distinct classification variants, yet Expiro alone accounted for 80.0% of the total virus detection volume.

Expiro is a long-established polymorphic file infector that appends itself to Windows executable files. The next three families—Floxif (4.9%), Sality (2.4%), and Virut (1.8%)—are also established, file-infecting malware families. Together, Expiro, Floxif, Sality, and Virut accounted for 89.1% of the total virus category, while all remaining families contributed the remaining 10.9%.

Figure 4. Virus Families Processed by Point Wild.

4. Prominent Malware Families Observed in the Wild

Public sandbox and threat-intelligence telemetry provide additional visibility into malware families active during the Q3 2026 period. The Malware Trends show continued activity from RATs and information stealers, including AsyncRAT, ACR Stealer, XWorm, Remcos, LokiBot, AgentTesla, DCRat, SalatStealer, and FormBook.

Figure 5. Prominent malware families observed in the wild
Source: ANY.RUN Malware Trends Tracker.

4.1 ACR Stealer

ACR Stealer was among the prominent information-stealing malware families highlighted during the Q3 2026 threat landscape. Microsoft Defender Experts reported increased activity from late April through mid-June 2026, with campaigns using ClickFix-based social engineering to initiate execution.

Microsoft identified two distinct intrusion chains. The first used a WebDAV-based delivery mechanism, Python loaders, PowerShell, and scheduled-task persistence. The second followed a more fileless execution model, using MSHTA, obfuscated PowerShell, steganography, and in-memory payload execution.

The campaigns employed multiple defense-evasion techniques, including obfuscation, masquerading, timestomping, command-history clearing, and, in some intrusions, blockchain-backed dead-drop C2 resolution. Initial ClickFix lures were associated with malvertising and SEO-manipulated search results. The observed activity focused primarily on browser-stored credentials, authentication tokens, cookies, and sensitive documents.

The activity demonstrates how information stealers are increasingly delivered through multi-stage execution chains that combine social engineering, legitimate Windows utilities, scripting engines, remote content retrieval, and memory-based execution.

ClickFix	Initial social-engineering lure
Disk-based chain	WebDAV → Python loader → Scheduled Task → Stealer
Fileless chain	MSHTA → Obfuscated PowerShell → In-memory execution
Evasion / C2	Timestomping, obfuscation, history clearing, blockchain-backed dead-drop C2 in some intrusions

Figure 6. Two ACR Stealer intrusion chains documented by Microsoft Defender Experts

4.2 SalatStealer

SalatStealer maintained a notable position within the observed threat landscape. This information-stealing family primarily focuses on harvesting sensitive corporate credentials and confidential enterprise telemetry from compromised endpoints.

Point Wild Threat Intelligence processed SalatStealer samples across 44 distinct classification variants. Trojan-based implementations dominated the volume at 95.1% of files, while Spyware accounted for 2.5% and PSW 2.4%.

The telemetry reveals a pronounced divergence between sample volume and strain variability. PSW classifications represent just 2.4% of files but 72.7% of all variants, whereas Trojan classifications invert that ratio entirely — 95.1% of files across only 18.2% of variants. In other words, the password-stealing component is where the family’s structural change concentrates, while the Trojan payload is recompiled at scale from a small, stable set of builds.

Figure 7. SalatStealer activity by malware classification.
Source: Point Wild Threat Intelligence Q3 2026 telemetry.

5. Ransomware Trends

Ransomware activity during Q3 2026 continued to involve structured, multi-stage intrusion operations. Reported campaigns commonly combine exploitation of internet-facing infrastructure, stolen or purchased credentials, lateral movement, security tool disruption, data exfiltration, and multi-platform encryption. Public ransomware tracking also showed continued activity across multiple regions and sectors during Q3 2026, with business organizations accounting for the largest share of publicly reported incidents.

Figure 8. Selected ransomware groups by confirmed victims — Q3 2026.
Source: Public ransomware threat-intelligence and ransomware-tracking data compiled for the Q3 2026 analysis.

5.1 The Gentlemen

The Gentlemen ransomware operation continued to demonstrate significant activity during 2026. Reported intrusions involved exploitation of exposed perimeter infrastructure, including internet-facing security appliances and remote-access services, as well as compromised credentials and access obtained through initial-access brokers.

Observed attack chains included Active Directory reconnaissance, security-tool disruption, proxy-based command and control, lateral movement through remote administration utilities, data exfiltration, and centralized deployment of ransomware through domain infrastructure. The group’s use of Go-based lockers targeting Windows, Linux, NAS, BSD, and ESXi environments demonstrates a multi-platform approach to encryption.

5.2 Qilin

Qilin remained a prominent ransomware operation during Q3 2026, with reported activity across multiple sectors. Affiliates have used stolen credentials, exposed remote-access infrastructure, and social-engineering techniques for initial access, followed by data exfiltration and encryption as part of a double-extortion model.

Qilin’s cross-platform capabilities, including targeting of Windows, Linux, and VMware ESXi environments, allow affiliates to operate across heterogeneous environments.

5.3 INC Ransom

INC Ransom also remained active during the quarter. Public reporting indicates continued activity involving access to privileged data and potential supply-chain or vendor compromise. Changes in victim-posting activity should be interpreted carefully because leak-site activity does not necessarily provide a complete measurement of underlying intrusion volume.

5.4 Regional Impact of Ransomware

Across Q3 2026, Comparitech recorded 1,066 reported attacks in the United States, followed by Germany (121), Canada (103), Italy (86), India (80), and Argentina (45). The United States accounted for approximately 41% of the quarter’s reported attacks. India saw a 116% increase compared with Q2 2026, highlighting a notable quarter-on-quarter rise. Counts include confirmed and unconfirmed reports and may change as claims are reclassified.

Figure 9. Ransomware activity by impacted region
Note: Reported attacks include confirmed and unconfirmed incidents.
Source: Comparitech, Q3 2026 Ransomware Roundup

5.5 Industries Impacted by Ransomware

Q3 2026 data shows ransomware activity spanning a wide range of operational sectors. Manufacturing accounted for the largest share at 24.9%, followed by Service (18.4%) and Technology (13.1%). Finance and Retail represented 9.9% and 9.2%, respectively. Healthcare and Food & Beverage each accounted for 5.6%, while Construction, Legal, Transportation, and Utilities recorded smaller shares.

Overall, the distribution highlights that ransomware continues to affect both technology-dependent industries and traditional operational sectors, with the top five sectors representing 75.5% of reported claims during the period. The figures are based on Q3 reported ransomware claims and include both confirmed and unconfirmed claims.

Figure 10. Ransomware activity by industry

Source: Comparitech Worldwide Ransomware Tracker.

6. Top Exploited Vulnerabilities in Q3 2026

Q3 2026 saw continued exploitation of vulnerabilities affecting internet-facing enterprise infrastructure, security-management platforms, collaboration software, virtualization platforms, and remote-access technologies. CISA added multiple vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog during Q3 based on evidence of active exploitation.

Notable vulnerabilities included CVE-2026-58644 in Microsoft SharePoint, CVE-2026-25089 and CVE-2026-39808 in Fortinet FortiSandbox, CVE-2026-59310 in VMware vCenter, CVE-2026-19490 in Citrix NetScaler, and CVE-2026-20079 in Cisco Secure Firewall Management Center. September activity also included vulnerabilities affecting Adobe Commerce/Magento and N-able N-central.

The Q3 vulnerabilities demonstrate a recurring focus on externally accessible and privileged technologies. Security management platforms, remote-access infrastructure, collaboration systems, and virtualization platforms can provide attackers with access beyond an individual endpoint, increasing their value as initial access or lateral movement targets.

CVE	Affected Technology	CVSS	Q3 2026 Exploitation / Significance
CVE-2026-20079	Cisco Secure Firewall Management Center / Security Cloud Control	10.0	Authentication bypass that can lead to root-level remote code execution
CVE-2026-75650	Adobe Commerce / Magento	10.0	Template-engine injection enabling unauthenticated remote code execution
CVE-2026-86218	N-able N-central	10.0	Static code injection enabling pre-authentication remote code execution
CVE-2026-59310	VMware vCenter	9.8	Path-traversal vulnerability in the Syslog server that could enable arbitrary code execution
CVE-2026-19490	Citrix NetScaler ADC / Gateway	9.8	Authentication bypass affecting NetScaler Gateway/AAA configuration
CVE-2026-58644	Microsoft SharePoint Server	9.8	Deserialization of untrusted data enabling network-based remote code execution
CVE-2026-25089	Fortinet FortiSandbox	9.1	OS command injection vulnerability allowing command execution through crafted HTTP requests
CVE-2026-39808	Fortinet FortiSandbox	9.1	OS command injection vulnerability

Figure 11. Selected High-Severity Vulnerabilities with Confirmed Exploitation in Q3 2026

7. Supply Chain Attacks

Malicious package activity remains heavily concentrated in a single ecosystem. According to Phoenix Security’s Malware Package Intelligence corpus, npm accounts for 79.3% of indexed malicious-package indicators, ahead of PyPI at 9.0%, VS Code and OpenVSX at 6.2%, other registries at 4.7%, and NuGet at 0.8%. The low PyPI and NuGet figures reflect relocation rather than safety: Phoenix Security, citing ReversingLabs data, reports that malware in both registries declined sharply by 43% and 60%, respectively, after they introduced mandatory two-factor authentication and trusted publishing, indicating attackers route around friction rather than persist against it. For Windows estates, the relevant point is that npm, NuGet, and VS Code all run on developer workstations and build agents, so the exposure sits inside the development environment rather than at the endpoint.

Figure 12. Malicious packages from the start of 2026 to date.

8. AI-Enabled Attack Activity

Q3 2026 saw adversarial AI shift from simple prompting toward greater automation. Google Threat Intelligence Group reported multi-agent frameworks capable of automated scanning, error resolution, credential harvesting, and other attack tasks.

One campaign used an AI coding chatbot and agent instructions to build and execute a large-scale credential-harvesting operation in under six hours, compromising thousands of credentials. Other activities targeted developer ecosystems and AI-assisted development tools.

However, fully autonomous hacking remains uncommon. The key Q3 trend was faster, more automated attack execution rather than humans being replaced by AI.

Traditional AI-Assisted Activity	Emerging Agentic Activity
Generates code or commands	Plans and executes multi-step tasks
Requires frequent human input	Operates with reduced human intervention
Executes predefined actions	Adapts based on results and errors
Individual tools/scripts	Coordinates multiple tools and agents
Human-speed operations	Potential for machine-speed operations

Figure 13. Traditional AI-assisted activity vs. emerging agentic attack activity.

9. Key Findings

Trojans remained the largest malware category at 48% of Q3 processing, with the top five categories accounting for 84% of the distribution.
Virus volume was highly concentrated: the Expiro file infector alone represented 80.0% of the category, a propagation artefact rather than evidence of new operator activity.
Point Wild research identified increasingly layered Windows delivery chains using trusted signed components, scripting engines, encryption, and anti-analysis techniques.
On-premises Microsoft SharePoint Server was the focus of Q3 Windows exploitation, with several vulnerabilities weaponised before patches shipped and machine-key theft enabling persistence after patching.
Ransomware operators continued to exploit exposed infrastructure, stolen credentials, and multi-stage lateral-movement workflows, with manufacturing the most affected industry at 24.9% of reported claims.
Software supply-chain attacks remained concentrated in npm, which accounts for 79.3% of indexed malicious packages, enabling malicious code to reach downstream projects through trusted dependencies.
Exploited vulnerabilities continued to affect internet-facing appliances, collaboration platforms, virtualization infrastructure, and network devices.

10. Methodology and Data Sources

This report combines Point Wild research findings with selected public threat-intelligence and malware-tracking sources to provide a Q3 2026 threat landscape view. The report distinguishes Point Wild research and telemetry from external datasets and public reporting.

Point Wild internal malware trend distribution and research findings.
ANY.RUN Malware Trends Tracker for a continuously updated sandbox activity snapshot.
Microsoft Security reporting for the ACR Stealer intrusion chains.
Public ransomware intelligence and tracking sources for ransomware activity and regional/sector observations.

11. References

Keep reading

Malware Analysis Report