Subscribe & Save 20% off Premium or Families plans
By subscribing, you agree to receive marketing communications regarding industry news and research, educational resources, and LastPass products and services. The processing of your personal data in accordance with the LastPass Privacy Policy. You can unsubscribe from marketing communications at any time.
- In 2025, the top malware used in attacks are infostealers, ransomware, cryptojacking malware, and RATs.
- Ransomware isn’t just a threat that happens to someone else: In 2025, attackers are targeting hospitals and the very services you rely on for your life.
- Today’s attackers aren’t breaking in; they’re signing in and maintaining persistence in your systems.
- Think micro-segmentation is enough? Attackers are weaponizing your trust to rewrite the attack playbook.
- LastPass FIDO2 MFA is your first line defense against malware attacks, locking down access to keep intruders out.
Are your phone calls safe – or is malware recording every juicy tidbit from your conversations? Once confined to the dark corners of geek speak, malware attacks - malicious software that compromises networks – have become mainstream.
As phishing soars, these attacks are riding the wave. Few know AI-driven phishing is amplifying the delivery of malware, however. And that this unholy alliance is behind the most devastating attacks of our generation. Below, the numbers tell a chilling story.
What is a malware attack?
But first, let’s start with definitions. A malware attack is a cyberattack, where malicious programs are used to take control of or sabotage computer networks. Here's what attackers are after:
- Your money, by encrypting files and demanding payment
- Your sensitive information, such as business data, intellectual property, and passwords
- Control of your network, to shut down critical services or cause chaos for strategic gain
In 2025, the top malware used in attacks are:
- Credential stealing infostealers like Lumma Stealer
- Loader malware like SocGholish
- Cryptojacking malware like CoinMiner
- Remote access trojans (RAT) like Agent Tesla and VenomRAT
- Ransomware like Blackcat/ALPHV
And the perpetrators? They are:
- Organized crime groups like Akira, LockBit, Blackcat, and FIN7, which are focused on ransomware and data exfiltration
- Hacktivist groups like the pro-Kremlin MoroccanCyberForces and its ally, RuskiNet, linked to ransomware campaigns and phishing attacks against critical infrastructure in Eastern Europe and the Middle East
- Nation state actors like APT31, APT33, Lazarus, and Sandworm
Understanding the threat is step one. Now brace yourself for numbers that prove just how relentless these attacks were last year.
How many malware attacks were there in 2024?
In 2024, there were over 6.5 billion malware attacks worldwide, up 8% YOY (year-over-year).
According to Astra Security’s 2025 pentesting report:
- 560,000 pieces of malware are released daily.
- Trojans account for 58% of all computer malware.
- Every minute, four (4) organizations become ransomware victims.
- Email is responsible for 91% of all attacks.
- Yet, 60% of businesses have 500+ passwords that never expire.
The sheer volume only scratches the surface.
Ransomware attacks surged 15% in 2024, reaching 5,289 incidents worldwide. The healthcare sector bore the brunt of this assault.
In the UK, a ransomware attack on Synnovis (a firm that analyzes blood tests) stopped more than 800 operations, 97 cancer treatments, and five (5) planned C-sections. All had to be rescheduled.
Meanwhile, pathology services fell to 10% of normal capacity, forcing several London hospitals to beg medical students to volunteer for 10 to12 hour shifts.
In 2024, the average ransom demand was $3.6 million, although the figure is higher for healthcare and government organizations.
If 2024 was alarming, 2025 has revealed something far more sinister, a fundamental shift in how attackers target the everyday person.
How are people targeted with malware?
In 2025, people are targeted with malware through several attack vectors such as:
- Social engineering like spear phishing, smishing, and vishing
- LOL (living off the land) fileless techniques
- Malvertising and fake browser update pop-ups
Attack vector #1: Social engineering
Social engineering is by far the most popular method to sneak malware onto your device.
It’s highly favored by APT groups, who weaponize spear phishing, smishing, or vishing to attack what the most sophisticated technical defenses can’t fix: the human mind.
Convincing flattery, fake urgency, and that well-timed “IT support” request makes you lower your guard – like nothing else can.
It lets attackers skip over your firewalls and other technical controls to get what they’re after: persistent access.
In late October, I attended the 2025 ISC2 Security Congress. As an ISC2 member, I also served as a virtual chat moderator, which allowed me to engage with an impressively vibrant and diverse group of security professionals.
Amidst the non-stop noise of endless threats and screaming headlines, we learned a critical truth: It’s the silent storms brewing beneath the surface that bring the most damage.
During a session on state-sponsored espionage, speaker Dr. Thomas Graham (VP & CISO at Redspin) made a sobering point:
Phishing is how APTs begin every single campaign. Attackers aren’t breaking in. They’re logging in. And they are bypassing your perimeter to weaponize your trust. Firewalls rarely stop initial access.
Dr. Graham stresses that APT groups are weaponizing trust in the systems we use daily. Think platforms such as Webex, Teams, Slack, and Zoom.
Because we trust these tools, we’re less suspicious of:
- A Zoom meeting link in an email
- A Teams message from what looks like a trusted colleague
- A calendar invite that looks “real”
Once the attackers gain initial access, they can:
- Move laterally to access shared resources
- Hide C2 (command & control) in normal Teams or Slack traffic
- Exfiltrate data through file-sharing features
The problem isn’t Teams or Zoom, it’s our conditioned trust.
In the now infamous 2007 espionage campaign, APT31 managed to infiltrate a Lockheed Martin subcontractor’s network. Their initial access tactic? Malware-infected spear phishing emails.
APT31 has been extremely successful in impersonating trusted insiders and journalists, often targeting third-party vendors like small machine shops or parts suppliers with less than stellar security and indirect access to classified military programs.
And in 2007, they used spear phishing to devastating effectiveness, allowing them to exfiltrate top-secret technical documents relating to the F-35 fighter jet, including radar designs and detailed engine schematics.
According to Dr. Graham, stealthy malware is the heartbeat of APT campaigns. Why? It can lie dormant for months, allowing the attackers to hide their C2 traffic inside the noise of your normal flow.
And the most chilling of all: Dr. Graham says attackers are weaponizing fileless techniques to bypass your antivirus and EDR protections.
Attack vector #2: LOTL fileless techniques
So, how do LOTL (living-off-the-land) fileless techniques work?
Quite simply, it means using legitimate system tools to execute and sustain an attack.
If you’re familiar with this, you understand the challenge of detecting fileless threats that hide in tools and processes like CertUtil, svchost.exe, PowerShell, and WMI (Windows Management Instrumentation).
When nation state groups like APT31 and APT10 breach a system, they tend to fire up PowerShell 28.49% of the time. Why? Because it’s already there, and every security system expects to see it running.
The attackers may use a reverse shell like PowerShell-GitHub-Shell. This reverse shell contacts a GitHut gist account (a repository for sharing code snippets with others), retrieves commands posted in the comment section, and executes them on the target system.
Then, the compromised system posts data back to the same comment section, which is retrieved by the attackers.
Another popular tactic is to use a technique called process hollowing, a form of process injection. First, the attackers fire up svchost.exe and then suspend it before it actually runs. Next, they unmap (erase) the actual code that was supposed to run and inject their own payload code into the now-empty memory space. Now, the code runs under the guise of a trusted application.
So, when you open Task Manager, you see svchost.exe, a normal Windows process. You don’t see the malicious payload that’s been injected.
Attack vector #3: Remote code execution
Remote code execution is the attack that keeps security experts up at night. In October 2025, Microsoft discovered a critical flaw that affects every Windows Server version from 2012 to 2025.
Tracked as CVE-2025-59287, this deadly flaw affected Windows servers with the WSUS Server Role enabled. It was a critical remote code execution vulnerability that allowed attackers to run harmful code with SYSTEM privileges, without the need for user interaction.
Here’s what this means: In a hierarchical structure where one server acts as an update server for downstream WSUS servers, the lead server is the prize attackers target.
This is because a compromised top-level server becomes the perfect gateway for them to attack all servers below it, amplifying the damage exponentially.
Attack vector #4: Malvertising and fake browser update pop-ups
It’s Friday night, and you’re browsing social media when an ad catches your eye.
But click on it, and you risk infecting your computer.
As malvertising continues to be one of the top vectors for malware, Google has prioritized ad safety.
In April 2024, Google blocked over 5.1 billion malicious ads and suspended close to 40 million advertiser accounts.
Despite Google’s efforts, a single malvertising campaign compromised nearly one million devices worldwide.
The attack targeted users who visited illegal streaming sites to watch pirated videos. On those sites, attackers embedded malvertising redirectors in movie frames to redirect people through several intermediate sites. The final destination was a malicious GitHub repository.
Once on GitHub, malware on the platform established a foothold on user devices and “dropped” (installed) more payloads in several stages.
Second-stage malware conducted reconnaissance and scanned for cryptocurrency wallets. Meanwhile, third-stage malware aimed for persistence, C2 (command & control) communications, and data exfiltration.
Building on the malvertising playbook, fake browser update pop-ups are targeting people who land on risky sites through redirects.
In February 2025, Proofpoint identified two threat actors (TA2726 and TA2727) who used fake browser updates to infect devices with infostealers like Lumma Stealer (Windows) and FrigidStealer (Mac).
Here’s why attackers use the fake update tactic: Because it plays on your natural instinct to keep your software current. They use convincing websites that look legitimate, with the entire process designed to get you to panic and act quickly.
Once your device is infected, the malware can bypass security tools like Windows Defender or Mac’s Gatekeeper, leaving your system exposed and vulnerable to more malware infections.
So, the question begs to be asked: What can be done about this?
How do you detect and prevent malware attacks?
Now that you’ve seen the threat up –front, let’s talk about how you can detect and prevent malware attacks:
#1 FIDO2 MFA as a first line of defense
Did you know? In 2022, the OMB (Office of Management and Budget) published a Federal Zero Trust Strategy in support of Executive Order 14028.
The memorandum requires federal agency staff, contractors, and partners to use only phishing-resistant MFA (like FIDO2 MFA).
Here’s why: Phishing continues to be the #1 attack vector. In 2025, AI-powered campaigns have contributed to a whopping 1,265% increase in email phishing.
But what makes FIDO2 MFA different from traditional SMS-based MFA?
First, SMS-based MFA codes are being retrieved by nation state attackers like Salt Typhoon. And second, this type of MFA is susceptible to bypass attacks.
Meanwhile, FIDO2 MFA like passkeys or hardware security keys tie logins to physical possession of your device and your unique biometrics. A July 2025 analysis by Ars Technica confirms there are currently no verified cases of attackers successfully phishing users protected by FIDO2 MFA.
Instead, attackers have only been successful in tricking users into downgrading to weaker MFA (such as SMS-based MFA), when FIDO2 isn’t enforced.
The bottom line?
If you have a business, your revenues are on the line. Get FIDO2 MFA now with a free trial of LastPass Business Max today (no credit card required).
#2 Modern EDR/XDR with behavioral analytics
Remember how APT groups leverage fileless malware to evade detection?
You need tools that watch how your system behaves, not just what files exist. EDR/XDR tools that use AI-powered behavioral analytics can help detect suspicious behaviors before real damage occurs.
For example, CrowdStrike has partnered with Intel to integrate accelerated memory scanning into the Falcon sensor. This technology allows the Falcon sensor to search through the memory space, looking for malicious shellcode patterns that are indicative of a fileless attack.
And that’s not all. When CrowdStrike’s rapid response teams identify a new fileless threat, they can write new detection rules and immediately send those rules to all endpoints.
This means that when a threat is identified in New York, CrowdStrike’s team can also deploy protection to endpoints in London, ensuring all endpoints worldwide are protected. And this can happen within minutes of CrowdStrike detecting the fileless attack.
#3 Network micro-segmentation
Here’s a scenario that happens every day. When attackers get into Jim’s laptop in accounting, lateral movement is easy when Bob’s laptop can talk to the engineering servers, and the engineering servers can talk to the R&D databases.
In September 2025, APT actors compromised a Philippine-based military firm using a fileless malware framework called EggStreme.
This LOTL approach enables extensive system reconnaissance, lateral movement, and data theft.
This is where Zero Trust micro-segmentation comes in. It treats every communication as hostile until verified.
In 2025, agentless, automated micro-segmentation is overcoming the limitations of traditional micro-segmentation and giving businesses a faster, simpler way to Zero Trust resilience.
This new approach buys you TIME by making attackers work for every inch of ground they gain.
#4 Proactive threat hunting
Dr. Graham warns that APT groups are patient. Once inside your system, they move quietly, living off the land until persistence is permanent.
While threat hunting is a critical first step, intelligence-led detection paired with expert human analysis is a novel approach that identifies behaviors and tradecraft that conventional tools may miss.
Operating as an extension of your own security team, CrowdStrike’s Falcon Adversary Overwatch is a managed threat hunting service that ensures threats don’t get missed.
The Falcon Overwatch team consists of elite experts who identify and stop more than 15,000 breach attempts a year. When they find a threat, they work with your team to investigate and remediate, before it becomes a full-blown breach.
#5 Strengthening your human firewall
As mentioned, malware attacks typically begin with some form of social engineering.
Thus, security awareness training is crucial in protecting employees, your human firewall.
Here’s the reality: About 3.4 billion phishing emails are sent every month. They’re going to your IT department, receptionist, sales & marketing teams, and HR crew, people who are busy doing their jobs.
You can have CrowdStrike Falcon running on every endpoint and automated micro-segmentation enforcing Zero Trust access.
But the second someone panics and clicks “Your payroll deposit failed: Click here to resolve” and enters their credentials, the attackers are now inside your perimeter.
Good awareness training teaches pattern recognition and creates personal resilience. Above all, it removes the “shame” factor, empowering employees to report phishing emails instead of quietly clicking ‘delete’ to avoid embarrassment.
According to KnowBe4, organizations that deploy security awareness training are 8.3 times less likely to experience a breach.
And remember, even if someone slips up, FIDO2 MFA provides a powerful defense that stops attackers at the door.
Ready to lock down your accounts?
If you’re protecting personal accounts, start using passkeys and store them in LastPass with a free 30-day trial of Premium.
If you’re doing business, use passkeys or hardware security keys to lock down your sensitive data and critical systems. Get FIDO2 MFA with a free trial of Business Max today.
No credit card is required for free trials because we prefer to earn your trust through results.
I have been using LastPass for the last two and a half years, daily, and this is the most reliable password manager I have used to date... Over the last two and a half years of my experience, I have never seen LastPass being down or having any kind of issue while being implemented...In fact, in my organization, it is mandatory to use LastPass as it is the most secure and most trusted platform. We even use LastPass for generating passwords...Sources
https://www.pcmag.com/how-to/how-to-tell-if-your-phone-is-being-tapped-what-to-do
https://explodingtopics.com/blog/cybersecurity-stats
https://www.getastra.com/reports/state-of-continous-pentesting-insights/2025
https://www.getastra.com/blog/security-audit/malware-statistics/
https://www.nytimes.com/2024/06/13/world/europe/nhs-london-hospital-cyberattack.html
https://www.nytimes.com/2025/09/04/world/asia/china-hack-salt-typhoon.html
https://www.nytimes.com/2024/12/14/us/cyberattack-rhode-island-ribridges-snap-medicaid.html
https://www.dni.gov/files/CTIIC/documents/products/Worldwide_Ransomware_2024.pdf
https://www.hipaajournal.com/ransomware-groups-evolving-tactics-1m-increase-ransom-demands/
https://mjolnirsecurity.com/anatomy-of-a-threat-apt31-and-the-global-espionage-campaign/
https://socradar.io/living-off-the-land-lotl-the-invisible-cyber-threat-lurking-in-your-system/
https://www.idstrong.com/sentinel/what-is-spim/
FAQs: Malware attacks
Resetting a device removes most malware by returning it to its original factory settings. However, advanced malware like rootkits or firmware viruses can survive a reset. Also, restoring from backups can reinfect your device, especially when the backup was made while your device was infected.
A reset is a strong first step but not foolproof.
Attackers execute malware by embedding malicious code in trusted scripts like Powerscript or JavaScript. When run, the script executes commands that download, install, or activate malware on the target system.
Signs of phone monitoring include unusually fast draining batteries, lagging device performance, strange noises during calls, and unexplained app crashes.
Also, unfamiliar apps and setting changes can indicate your device has been infected by spyware.
For computers, Windows is the most targeted by a wide margin, due to its larger market share than macOS. In recent years, however, Microsoft has made major improvements with features like Microsoft Defender, which provides strong, built-in protection.
Meanwhile, Linux is less targeted than either Windows or macOS because only a minority of everyday users run Linux on their systems. On mobile devices, Android is 50% more likely to be infected with malware than iOS.
SPIM (spam over instant messaging) attacks embed malware distributing links in instant messages. These attacks often target the younger demographic (18-34 age group).
Attackers often send enticing messages to encourage IM users to click on links that take them to phishing or credential harvesting sites.
Rootkits are notably the most difficult to remove. This is because they operate at the highest level of privileges and can hide deep within firmware such as BIOS or UEFI.
Kernel-mode rootkits and bootkits, in particular, can survive system resets.
Subscribe & Save 20% off Premium or Families plans
By subscribing, you agree to receive marketing communications regarding industry news and research, educational resources, and LastPass products and services. The processing of your personal data in accordance with the LastPass Privacy Policy. You can unsubscribe from marketing communications at any time.
