Top 10 Malware Used by Hackers Last Week to Launch Cyberattacks

Cybercriminals continued to lean on a familiar arsenal of malware last week, with information stealers and remote access trojans (RATs) dominating the threat landscape as the primary tools for initial access, credential theft, and long-term system control. Topping the list is Vidar, an infostealer that logged 282 detections, narrowly edging out AsyncRAT, a widely abused open-source RAT that recorded 275 hits despite a sharp weekly decline. Remcos and XWorm rounded out the top four with 195 and 192 detections respectively, underscoring how threat actors continue to favor modular RATs capable of keylogging, webcam surveillance, and remote desktop control for espionage and financial theft. Weekly telemetry from ANY.RUN’s interactive sandbox for the period ending July 20, 2026 shows malware activity concentrated around ten repeat-offender families rather than a wave of new threats. Vidar (282 uploads) and AsyncRAT (275 uploads) top the chart, followed by Remcos, Xworm, StealC, AgentTesla, DonutLoader, Lumma, Snake Keylogger, and Quasar. Nine of ten families saw uploads decline week-over-week, with AsyncRAT’s activity dropping by 1,431 detections, the sharpest fall in the set, while Lumma (+18) and Snake (+28) were the only families trending upward. Weekly malware detection rankings (Image Source: Cybersecuritynews.com) For defenders, the real signal isn’t the…