Malware figures are quoted everywhere, but most "malware statistics" pages recycle numbers with no source, no year and no explanation of what was counted. This page collects current figures on malware volumes, infostealers, the most detected families, delivery channels and mobile malware, each with the publisher, report and period stated and a link to the original. Ransomware is covered separately in the Ransomware Statistics Guide. It is written for security leaders who need defensible numbers and for practitioners deciding where to put controls. Every figure is vendor or agency telemetry with its own method, so read the "what was counted" notes before comparing numbers. Last reviewed: November 2026.
Key takeaways
- Volume is enormous and still rising. Kaspersky detected an average of 500,000 malicious files per day in 2025, 7% more than in 2024; AV-TEST registers over 450,000 new malicious programs and potentially unwanted applications every day.
- Credential theft is the fastest-growing category. Kaspersky's password stealer detections rose 59% and spyware 51% year on year (November 2024 to October 2025).
- Stealers lead sandbox detections. ANY.RUN's 2025 data puts stealers first by type (155,741 detections) and Lumma first by family (31,111).
- Phishing remains the main way in. ENISA found phishing behind about 60% of initial intrusions in the EU incidents it analysed for July 2024 to June 2025.
- Mobile banking malware is surging. Kaspersky counted 255,090 new mobile banking Trojan installation packages in 2025, a several-fold increase, while total new mobile malware packages fell by nearly a third.
Malware volumes
| Figure | Source and period | What was counted |
|---|---|---|
| 500,000 malicious files detected per day on average, up 7% on 2024 | Kaspersky, "The number of the year" (2 December 2025), November 2024 to October 2025 | Malicious files detected by Kaspersky Security Network |
| Over 450,000 new malicious programs and potentially unwanted applications registered per day | AV-TEST malware statistics page (the page shows no date for this figure; read November 2026) | New samples of malware and PUA combined in AV-TEST's collection |
| 48% of Windows users and 29% of macOS users encountered cyber threats | Kaspersky Security Bulletin 2025, Statistics (2 December 2025), November 2024 to October 2025 | Share of Kaspersky users whose devices encountered a threat |
| 27% of users encountered web threats; 33% were affected by on-device threats | Kaspersky Security Bulletin 2025, Statistics | Share of Kaspersky users |
Sample counts measure how many distinct files exist, not how many attacks happen. Automated repacking produces new hashes for the same malware, which is why daily sample counts run into the hundreds of thousands and why hash-based blocking alone cannot keep up.
Infostealer statistics
| Figure | Source and period |
|---|---|
| Password stealer detections up 59% year on year | Kaspersky press release (2 December 2025), November 2024 to October 2025 |
| Spyware detections up 51%; backdoor detections up 6% | Kaspersky press release (2 December 2025) |
| Password stealer detections in Asia Pacific up 132% | Kaspersky Security Bulletin 2025, Statistics |
| Over 394,000 Windows computers worldwide infected by Lumma between 16 March and 16 May 2025 | Europol, announcing the Lumma disruption with Microsoft (May 2025) |
| Stealers were the most detected malware type: 155,741 detections | ANY.RUN, Malware Trends 2025 (20 January 2026), calendar year 2025 |
Infostealers harvest saved browser passwords, session cookies, tokens and crypto wallets, then sell them as "logs". The Lumma figure covers only two months and only the computers Microsoft could identify, so it is a floor, not an estimate of total infections. For what to do with stolen logs, see the Infostealer Logs Monitoring and Response Guide and the Infostealer Threat Guide.
Most detected malware types and families
ANY.RUN publishes detection counts from submissions to its interactive sandbox. They show what analysts and SOCs are submitting, which leans towards commodity malware seen in email and downloads.
| Rank | Malware type (2025 detections) | Malware family (2025 detections) |
|---|---|---|
| 1 | Stealer: 155,741 | Lumma (stealer): 31,111 |
| 2 | RAT: 72,114 | XWorm (RAT): 31,093 |
| 3 | Loader: 69,651 | AsyncRAT (RAT): 16,372 |
| 4 | Ransomware: 42,220 | Remcos (RAT): 16,002 |
| 5 | Botnet: 24,022 | AgentTesla (stealer): 14,584 |
| 6 | Backdoor: 21,418 | Snake (keylogger and stealer): 13,556 |
| 7 | Keylogger: 16,144 | Quasar (RAT): 13,512 |
| 8 | Adware: 14,960 | Vidar (stealer): 10,303 |
| 9 | Trojan: 10,016 | Stealc (stealer): 9,927 |
| 10 | Miner: 8,442 | Amadey (loader): 9,533 |
Source: ANY.RUN, Malware Trends 2025 (published 20 January 2026), calendar year 2025. Family descriptions are NHI Mgmt Group's labels. Loaders rank third by type: they are the first-stage malware that installs stealers, RATs and ransomware. See the Malware Loaders and Droppers Guide.
Most detected techniques
| ATT&CK technique | 2025 detections (ANY.RUN) |
|---|---|
| T1553.004 Install Root Certificate | 385,915 |
| T1036.003 Rename Legitimate Utilities | 304,926 |
| T1059.003 Windows Command Shell | 257,253 |
| T1497.003 Time Based Checks | 255,303 |
| T1059.001 PowerShell | 235,402 |
| T1547.001 Registry Run Keys / Startup Folder | 172,330 |
| T1053.005 Scheduled Task | 158,154 |
These are the behaviours worth detection engineering effort: script interpreters, renamed system utilities, root certificate installation and the two most common persistence methods account for most observed activity.
Delivery channels
| Figure | Source and period |
|---|---|
| Phishing was the initial intrusion vector in about 60% of cases; vulnerability exploitation 21.3% | ENISA Threat Landscape 2025 (1 October 2025), 4,875 incidents, 1 July 2024 to 30 June 2025 |
| AI-supported phishing made up more than 80% of observed social engineering activity worldwide by early 2025 | ENISA Threat Landscape 2025, citing other reports |
| Executables, ZIP archives, PDFs and email files (EML, MSG) were the most analysed file types | ANY.RUN annual report 2025 (18 December 2025) |
| Tycoon2FA was the most detected phishing kit (107,125 detections), ahead of EvilProxy (37,524) | ANY.RUN, Malware Trends 2025 |
| Phishing click-throughs reported as about 40% higher on mobile (not shown on Verizon's public DBIR page; reported in secondary coverage of the full report, so check the PDF before quoting) | Verizon 2026 Data Breach Investigations Report |
ENISA's figures cover incidents with a known vector in its EU dataset; ENISA issued a revised version 1.3 of the report on 22 September 2026 correcting typographical and graphic design errors; the 60%, 21.3% and 4,875 incident figures above are as stated in version 1.3. Phishing kits such as Tycoon2FA steal session tokens rather than install malware, but they feed the same credential market as stealers. See the Phishing Statistics Guide and the ISO and Container File Malware Delivery Guide.
Mobile malware statistics
| Figure | Source and period |
|---|---|
| 14,059,465 mobile malware, adware and unwanted software attacks blocked | Kaspersky, "Mobile malware evolution in 2025" (Securelist, 4 March 2026) |
| 815,735 new malicious installation packages, down nearly one-third on the previous year | Kaspersky, Mobile malware evolution in 2025 |
| 255,090 new mobile banking Trojan packages; attacks by bankers grew 1.5 times | Kaspersky, Mobile malware evolution in 2025 |
| Adware was 62% of mobile detections; Mamont made up 49.8% of banking Trojan apps | Kaspersky, Mobile malware evolution in 2025 |
| About 1.75 million policy-violating apps prevented from being published on Google Play; more than 80,000 developer accounts banned | Google, "Keeping Google Play and Android app ecosystems safe in 2025" (19 February 2026) |
| More than 27 million new malicious apps from outside Google Play flagged by Play Protect; 266 million risky installation attempts blocked, from 872,000 unique high-risk apps | Google (19 February 2026), calendar year 2025 |
Kaspersky changed its mobile statistics method from Q3 2025 and recalculated earlier years, so its 2025 figures should not be compared with numbers published before that change. Kaspersky also reported backdoors preinstalled in device firmware (Triada and the newly found Keenadu), a supply chain problem that app store controls cannot catch. The Google figures, 27 million malicious apps found outside Google Play against 1.75 million policy-violating apps stopped at submission, point to sideloading as a major route for mobile malware. See the Mobile Malware Guide.
How to read malware statistics
The figures on this page come from four different kinds of source. Each answers a different question, and mixing them is the most common reason malware statistics get misquoted.
| Source type | Examples on this page | What it measures well | Limits |
|---|---|---|---|
| Endpoint security telemetry | Kaspersky Security Network | Detections and share of protected users affected, year-on-year change within one vendor | Reflects that vendor's customer base and regions; methods change between years |
| Sample collections | AV-TEST | How many distinct malicious files appear | Counts files, not attacks or victims; repacked variants inflate totals |
| Sandbox submissions | ANY.RUN | Which types, families and techniques analysts see most often | Driven by what users choose to submit; favours email and download malware |
| Agency and platform reports | ENISA, Europol, Google | Incident vectors across many organisations; scale of takedowns and store enforcement | Limited to incidents reported or devices visible to that body; often revised |
Three rules keep quotes defensible. First, always give the period: Kaspersky's "2025" runs from November 2024 to October 2025, not the calendar year. Second, say what was counted: files, detections, users, attacks or incidents. Third, compare a source only with its own earlier editions, and check for method changes such as the one Kaspersky made to mobile statistics in 2025.
What the numbers mean for defenders
- Assume credentials will be stolen: with stealer detections growing fastest, plan for stolen passwords and session cookies. Phishing-resistant authentication, short session lifetimes and token binding reduce what a stolen log is worth. See the Infostealer Logs and Session Token Abuse Guide.
- Machine credentials are in the logs too: stealers take whatever is on the device, including API keys, cloud CLI tokens and SSH keys stored by developers. Treat developer workstations as holders of non-human identity secrets and rotate them after any infection.
- Behaviour beats hashes: half a million malicious files detected a day, many of them repacked variants, defeats signature lists. The technique table shows where behavioural detections pay off: PowerShell and command shell misuse, renamed utilities, scheduled tasks and Run keys.
- Stop the first stage: loaders deliver most of the rest. Blocking script and archive attachments, macro execution and disk image auto-mount removes common entry paths. See the CIS Control 10 Malware Defenses Guide.
- Control sideloading on managed phones: block installation from unknown sources through mobile device management and keep Play Protect or equivalent enabled.
- Read vendor statistics as telemetry: each figure reflects one vendor's customer base and method. Use them for direction and proportion, not as global totals, and never add numbers from different publishers together.
Practitioner checklist
- Quote every malware figure with publisher, report, period and link, as in the tables above.
- Enforce phishing-resistant MFA and shorter session lifetimes for high-value applications to blunt stealer logs.
- Rotate API keys, tokens and SSH keys held on any device where a stealer is detected, not only user passwords.
- Build detections for the top observed techniques: PowerShell, command shell, scheduled tasks, Run keys and renamed utilities.
- Block or quarantine risky attachment types (scripts, disk images, password-protected archives) at the email gateway.
- Monitor infostealer log markets or a monitoring service for your domains and staff credentials.
- Block sideloading on managed mobile devices and inventory devices with firmware from unknown suppliers.
- Refresh this data annually from the same recurring sources so trends are like for like.
Standards and references
- Kaspersky: The number of the year, half a million malicious files daily in 2025
- Kaspersky Securelist: Kaspersky Security Bulletin 2025, Statistics
- Kaspersky Securelist: Mobile malware evolution in 2025
- AV-TEST: Malware statistics
- ANY.RUN: Malware Trends 2025
- ENISA: Threat Landscape 2025
- Europol: Europol and Microsoft disrupt world's largest infostealer Lumma
- Google: Keeping Google Play and Android app ecosystems safe in 2025
Related NHI Mgmt Group resources: Ransomware Statistics Guide · Malware Guide · Infostealer Threat Guide · Cybersecurity Statistics Guide