Malware Statistics 2026

Kaspersky’s detection systems discovered an average of 500,000 malicious files per day in 2025, marking a 7% increase compared to the previous year.

Every day, Microsoft processes more than 100 trillion signals, blocks approximately 4.5 million new malware attempts, analyzes 38 million identity risk detections, and screens 5 billion emails for malware and phishing.

During the reporting period: 48% of Windows users and 29% of macOS users encountered cyberthreats

On average worldwide, Malware local threats were detected at least once on 10.93% of users’ computers during Q2.

On average during the quarter, 4.54% of users’ computers worldwide were subjected to at least one Malware web attack.

AI-enabled adversaries increased operations by 89% year-over-year, weaponizing AI across reconnaissance, credential theft, and evasion.

Phishing attacks were followed, to a much lesser extent, by people impersonating organisations in emails or online (12% of businesses and 7% of charities) and then viruses or other malware (7% of businesses and 3% of charities).

Ransomware grew again to 48% of all breaches, up from 44% from the previous year.

Despite the relative stability in total payments, ransomware attacks surged across multiple vectors in 2025, with eCrime.ch data showing a 50% YoY increase in claimed ransomware victims, marking the most active year on record.

On the ransomware scene, victim numbers surpassed 2024 totals well before year’s end, with ESET Research projections pointing to a 40% year-over-year increase.

In 2025, the IC3 received more than 3,600 complaints reporting ransomware, with losses exceeding $32 million.

63 New Ransomware Variants Identified via IC3

There were 2538 new ransomware variants discovered.

Qilin reclaimed the top spot (accounting for 14.57% of total listings) after placing second last quarter.

However, nationally significant incidents represent 48% (204) of all incidents, a significant increase from last year (89) .

In FY2024–25, ASD’s ACSC responded to 138 ransomware incidents, 39% of which were the result of ASD’s ACSC contacting the entity to warn of a possible cyber security incident.

Ransomware attacks among businesses have declined compared with the previous two years (1% this year down from 3% in both 2024/2025 and 2023/2024) and phishing attacks and impersonation breaches or attacks, whilst not significantly different to last year, have significantly declined compared to two years ago (38% this year down from 42% in 2023/2024).

In 2025, ransomware actors received more than $820 million in on-chain payments — an 8% decline year-over-year (YoY) from $892 million, our updated 2024 estimate.

In particular, the median payment increased 368%, from $12,738 in 2024 to $59,556 in 2025.

Thanks to this dynamic, the share of ransoms paid potentially reached an all-time low this year at 28%.

Ransom payment rates have continued their long-term decline, reaching approximately 20% in the most recent quarter, representing a new historical low and extending the multi-year downward trajectory observed since 2020.

The trend shows up most noticeably in the data exfiltration only payment rate, which also dropped to a historically low level of 15%.

Ransomware payment metrics diverged sharply in Q2 2026: while the average ransom payment surged 176% from Q1 to $1,880,612 , the median payment fell by 50% to $150,000 .

Just under half (49%) paid the ransom and got their data back. While this represents a small reduction from last year’s 56%, it remains the second highest rate of ransom payments in the last six years.

826 organizations that paid the ransom shared both the initial demand and their actual payment, revealing that they paid, on average, 85% of the initial ransom demand.

Around half of businesses (49%) and a third of charities (34%) had a rule or policy to not pay ransomware demands, which was consistent with 2024/2025 (businesses 52% and charities 38%).

Technical root causes For the third year running, victims identified exploited vulnerabilities as the most common root cause of ransomware incidents, used to penetrate organizations in 32% of attacks overall.

Compromised credentials remain the second most common perceived attack vector, although the percentage of attacks that used this approach dropped from 29% in 2024 to 23% in 2025.

Email remains a major vector of attack, whether through malicious emails (19%) or phishing (18%).

We found that prior compromise ranked as the third-most common initial infection vector (10%) for intrusions globally, and the top initial infection vector in ransomware operations (30%), doubling what it was in 2024 (15%).

The combined share of ransomware, banking trojan, and infostealers accounts for 87.3% of these intrusions.

The average eCrime breakout time fell to just 29 minutes in 2025, with the fastest observed breakout occurring in only 27 seconds.

Lateral Movement and Exfiltration were tied as the most observed tactics, each appearing in 76% of cases.

The average (mean) cost to recover from a ransomware attack (excluding any ransom payment) dropped by 44% over the last year, coming in at $1.53 million, down from $2.73 million in 2024.

At the same time, over half of victims (53%) were recovered within a week, a significant jump from the 35% reported in 2024.

In total, Kaspersky solutions blocked 14,059,465 attacks throughout the year.

Adware remained the most prevalent mobile threat, accounting for 62% of all detections.

Mobile threat statistics 815,735 new unique installation packages were observed in 2025, showing a decrease compared to the previous year.

Mobile banking Trojans The number of new banking Trojan installation packages surged to 255,090, representing a several-fold increase over previous years.

And, last year, its real-time scanning capability identified more than 27 million new malicious apps from outside Google Play, warning users or blocking the app to neutralize the threat.

In 2025, we prevented over 1.75 million policy-violating apps from being published on Google Play and banned more than 80,000 bad developer accounts that attempted to publish harmful apps.

In 2025, we blocked 266 million risky installation attempts and helped protect users from 872,000 unique, high-risk applications.

On the Android platform, NFC threats continued to grow in scale and sophistication, with an 87% increase in ESET telemetry and several notable upgrades and campaigns observed in H2 2025.

Certain types of threats saw growth globally – there was a 59% surge in password stealer detections, a 51% growth in spyware detections and a 6% growth in backdoor detections compared to 2024.

In APAC password stealer detections saw a 132% surge compared to the previous year

Detections plummeted by 86% in H2 2025 compared to the first half of the year, and a significant distribution vector of Lumma Stealer – HTML/FakeCaptcha trojan, used in ClickFix attacks – nearly vanished from our telemetry.

ESET Research has documented over 100 EDR killers used in the wild, with new variants appearing regularly.

In H1 2026, ESET analyzed nearly 900,000 AI skills – small functional components used by AI agents – and identified tens of thousands of suspicious and thousands of outright malicious instances.

Less than 2.5% of the AI-assisted malware observations involved less- common techniques with one or fewer known malware examples.

One in four malicious breaches were AI-enabled – a 56% increase over last year – and these breaches cost an average of $6 million, roughly $1 million more than the global breach average of $4.99 million, according to IBM's 2026 Cost of a Data Breach Report.