Malware does not always make a device visibly fail. It may search photographs for wallet recovery phrases, arrive inside an application installer, or turn a website into a route to fraud. Entry methods and consequences vary, so response must follow where the malicious code actually runs.
This guide covers 37 entries comprising findings, variants, campaigns and infection cases documented in primary reports from 2025 through 18 October 2026. Examples include SparkCat, LummaStealer, NimDoor and DollyWay. Each entry explains the finding, its mechanism and the limits of the evidence. The number counts entries, not unique malware families or a ranking by infection prevalence.
Find your device or platform
You can start with the platform you use. Website owners can go straight to the section on website malware.
| Section | Coverage |
|---|---|
| Android | APKs, Accessibility permissions, photographs, banking and firmware |
| iOS and iPhone | Data-stealing apps and payloads delivered by exploit chains |
| Windows | Information stealers, loaders and ransomware |
| Mac and macOS | Fake installers, data theft and backdoors |
| Linux, servers and cloud | Remote access, cryptocurrency mining and exposed services |
| Website Malware | Redirects, fake plugins, webshells and databases |
| Packages and build systems | npm packages, development computers and CI systems |
| Initial response | Actions based on where an infection is suspected |
How this list was verified
Sources include the FBI/CISA/MS-ISAC joint advisory, Google Threat Intelligence Group, Microsoft and security research teams such as ESET, Kaspersky, Unit 42, Check Point, Jamf and Sucuri. Reports were selected for their sample analysis, telemetry or investigated incidents. Research hosted on vendor websites is assessed on that evidence; vendor marketing claims are not used to rank protective products.
A report's year is not necessarily a malware family's birth year. SparkCat and Auto-Color, for example, were disclosed in 2025 reports but have earlier traces. Older families are included where reports in this period document variants, operations or remaining infections. Sample-only findings, such as PromptSpy and VoidLink in their initial reports, are explicitly qualified.
This is a broad selection of checkable research, not an inventory of every malware family worldwide. Researchers may also use different names for related components or campaigns. The explanations summarize the named researchers' work; they do not claim that I executed or independently tested all the samples.
How malware works: understand its role first
Malware is harmful software that can steal information, disrupt systems or act without authorization. Several terms describe functions rather than individual families. Microsoft explains the basic malware categories.
| Term | Meaning for the user |
|---|---|
| Stealer | Collects information such as passwords or wallet data. |
| RAT / backdoor | Provides unauthorized remote access. |
| Ransomware | Extorts victims, usually by encrypting or stealing data. |
| Rootkit | Helps conceal malicious activity within a system. |
| Malicious cryptominer | Uses computing resources to mine cryptocurrency without permission. |
| Loader | Runs or downloads a subsequent malicious payload. |
| Webshell | Gives an attacker access through code on a web server. |
| C2 | A server or mechanism used to send malware commands. |
For each case, follow the sequence: entry route, executed code, obtained access and resulting action. Some cases involve one function; others combine several components. OXLOADER delivers CASTLESTEALER, for example, while Coruna delivers payloads to vulnerable iPhones. These roles help explain why different names in one attack do not necessarily identify the same malware.
Android malware
On Android, the distinction goes beyond an app’s name. Some attacks depend on permissions granted by the user; firmware and exploitation cases reach deeper into the system. Being able to install an APK does not establish that it is safe.
SparkCat
Report: 5 February 2025; activity traced to March 2024. Android and iOS.
SparkCat uses optical character recognition, or OCR, to find photographs containing wallet recovery phrases. After obtaining gallery access, malicious components send selected images to attackers. Kaspersky found affected apps in Google Play and the App Store. Both stores took action on the reported apps after disclosure. Kaspersky Securelist: SparkCat.
SparkKitty
Report: 23 June 2025; activity traced to at least February 2024. Android and iOS.
Where SparkCat selects images by their text, SparkKitty collects gallery photographs more broadly. It requests photo access, monitors images and uploads them to an attacker-controlled server. Researchers suspect cryptocurrency theft is one objective; that does not establish that every stolen photograph contains wallet information. The investigation covered apps distributed through several channels, including official stores. Ordinary personal photographs can still expose sensitive information without containing a password. Kaspersky Securelist: SparkKitty.
Crocodilus
Disclosed in March 2025. Android banking trojan.
Crocodilus abuses Android Accessibility services to read screen content and support remote control of the phone. It can place a fake sign-in overlay over financial apps. Another lure tells users to open their wallet recovery phrase because a backup is supposedly required, exposing it to the malware. The initial campaigns studied targeted Spain and Turkey. Those findings do not establish an Indonesian victim count. ThreatFabric: Crocodilus.
RatOn
2025 analysis; the examined samples carry July to August 2025 build dates.
RatOn combines remote control, deceptive screens and NFC abuse. In a relay attack, contactless card communication is forwarded so it can be misused elsewhere. Researchers also found transaction automation tailored to one particular banking app. That is not evidence of a universal ability to compromise every bank. The documented infection chain persuades users to install an APK and grant Accessibility permissions. ThreatFabric: RatOn.
BTMOB
ESET report: 26 May 2026; an already known malware family.
BTMOB is a remote access trojan, or RAT. In the Brazilian campaign investigated by ESET, pages impersonating an app store helped distribute malicious APKs. Once the required permissions are obtained, the malware can monitor the screen, collect data and give its operator remote access. The risk extends beyond an annoying app: an apparently functional phone can become a way to observe its owner's activity. ESET Research: BTMOB.
PromptSpy
Report: 19 February 2026. Verified samples; widespread deployment not established.
PromptSpy uses Gemini to interpret Android screens and help keep its app pinned in the recent-apps list. Its main malicious function remains VNC-based remote access. AI assists one operational step; the report does not establish a fully autonomous attack. At publication, ESET had not observed PromptSpy in its detection telemetry and noted that it might be a proof of concept. The samples are verified, but broad circulation is not. ESET Research: PromptSpy.
Hirudo
Analyzed activity: August to October 2026. Relevant to Indonesia.
Hirudo uses fake app-update lures and attempts to replace banking apps with modified copies. Security checks in those copies are altered to assist credential theft and remote control. ThreatFabric identified Indonesian banking apps in this operation. The attack concerns malicious copies running on users' devices. That finding does not, by itself, show that the banks' central systems were breached. ThreatFabric: Hirudo.
Triada: firmware variant
Report: 25 April 2025. A new variant of an older family.
In this investigation, Triada was embedded in the firmware of some counterfeit Android devices before buyers used them. Firmware is the foundational software that runs a device. The malware infiltrates the process from which many apps start, then loads modules that steal or manipulate data. Its deeper placement means deleting an ordinary app may not resolve the problem. The finding does not apply to all Android phones or all inexpensive devices. Kaspersky Securelist: Triada: firmware variant.
Keenadu
Report: 17 February 2026. Android backdoor with multiple distribution routes.
Keenadu was found through firmware, system apps and apps distributed through Google Play. Placement and capabilities vary between components. The observed activity primarily involved advertising fraud, including interactions not genuinely performed by the user. Backdoor access creates broader risks. Credential theft is discussed as a potential risk, rather than the main activity observed in this report. Kaspersky Securelist: Keenadu.
Operation NoVoice
Report: March 2026. A campaign name, not a single app.
This campaign disguises malware as apps such as cleaners, games or galleries. After checking the device, malicious components try to exploit older, unpatched vulnerabilities to obtain root, or system-level privileges. That access permits deeper changes than ordinary app permissions. Exposure depends on the device and its patch level. The report does not establish that every Android version can be compromised through the same method. McAfee Labs: Operation NoVoice.
iOS and iPhone malware
Platform restrictions do not eliminate every attack route. SparkCat and SparkKitty also involve iOS; see the SparkCat and SparkKitty entries above. The following cases distinguish phishing redirects from malware delivered through exploits for specific iOS versions.
FakeWallet
Report: 20 April 2026; related activity traced to late 2025. Android samples also found.
Kaspersky found phishing apps in the App Store that redirected users to imitation app-store pages. Those pages led to modified cryptocurrency wallets designed to steal recovery phrases or private keys. The redirecting app and the wallet stealer are separate parts of the chain. Android samples were also found on related phishing sites; this does not establish that the same malicious wallets were available in Google Play. Kaspersky Securelist: FakeWallet.
PLASMAGRID delivered through Coruna
Report: 3 March 2026; campaigns observed since 2025.
Coruna is an exploit kit used to compromise vulnerable iPhones. One payload delivered through the chain is PLASMAGRID, which targets financial information, including cryptocurrency-wallet data. Google's research covers iOS 13.0 through 17.2.1 and website-based delivery. Those version limits matter: the report does not mean every up-to-date iPhone is vulnerable. The mechanism that gains entry and the malware that steals data are separate parts of the attack. Google Threat Intelligence Group: PLASMAGRID delivered through Coruna.
GHOSTBLADE, GHOSTKNIFE and GHOSTSABER
Report: 18 March 2026; DarkSword use observed since November 2025.
DarkSword is an exploit chain for iOS 18.4 through 18.7 in the analyzed cases. Its payloads differ: GHOSTBLADE collects device data; GHOSTKNIFE has modules for stealing messages and browser data, and recording audio; GHOSTSABER is a backdoor that extracts data and executes JavaScript. These families appeared in different campaigns. The version range describes historical findings, not the condition of every current iPhone. Google Threat Intelligence Group: GHOSTBLADE, GHOSTKNIFE and GHOSTSABER.
Windows malware
This group includes malware that immediately steals information and components that prepare the way for a later attack. Ransomware adds another consequence: loss of file access and extortion pressure.
LummaStealer / LummaC2
Report: 21 May 2025. An older family active in 2025 campaigns.
Lumma steals information such as saved passwords, browser cookies and wallet data. One distribution method is ClickFix: a deceptive page tells users to run a command to complete a CAPTCHA or repair a supposed problem. The command instead starts an infection. Stolen cookies can also put account sessions at risk, so removing a malicious file is not the whole response. Not every infection uses the same delivery route. Microsoft Threat Intelligence: LummaStealer / LummaC2.
Medusa ransomware
Advisory: 12 March 2025; family identified since June 2021.
Medusa uses double extortion: attackers steal data, encrypt files and threaten to publish the stolen information. The joint advisory describes phishing and vulnerability exploitation among the initial access routes. The consequences can affect an organization's operations, not just an individual document. The name needs care: Medusa ransomware is distinct from MedusaLocker and from the Android malware also called Medusa. FBI, CISA, and MS-ISAC: Medusa ransomware.
VanHelsing
Report: 23 March 2025; samples discovered in March 2025.
VanHelsing emerged as a ransomware service available to attacker affiliates. The analyzed Windows samples encrypt files and create ransom notes. Researchers found multiple variants early in the operation. The operators advertised support for other platforms, but an attacker's marketing claim is not equivalent to sample analysis. This entry therefore covers Windows without treating every advertised platform as independently verified. Check Point Research: VanHelsing.
OysterLoader
Microsoft entry published 24 July 2025 and updated in September 2025.
OysterLoader spreads through installers that resemble popular applications. A malicious package can even launch the genuine app to make installation look normal while adding a backdoor. That component collects device information and enables further payload downloads. Scheduled tasks help maintain access. Seeing the expected application open successfully therefore does not establish that its installer was safe. Microsoft Security Intelligence: OysterLoader.
Argamal
Report: 3 June 2026; discovered in April 2026.
Argamal was embedded in infected adult-game packages. After execution, part of the malicious chain waits before activating its next stage. That delay can make the connection between installing the game and later symptoms harder to notice. The final payload is a RAT providing remote access. An application that appears to behave normally on its first day is therefore not necessarily free of malicious components. Kaspersky Securelist: Argamal.
OXLOADER and CASTLESTEALER
Report: 19 June 2026; advertising campaign observed in April 2026.
In this chain, fake Node.js download advertisements direct users to a malicious installer. OXLOADER runs the next stage, including the information-stealing CASTLESTEALER payload. The names describe different roles: a loader delivers further code, while a stealer collects data. This is distribution impersonation, not evidence that the official Node.js installer was compromised. A familiar logo alone does not verify the source of a download. Elastic Security Labs: OXLOADER and CASTLESTEALER.
Mac and macOS malware
Several Mac campaigns rely on trust in a familiar-looking app, contact or update. Pay attention to what the user is asked to run and where that file came from.
FrigidStealer
Report: 18 February 2025; activity observed in January 2025.
FrigidStealer targets Macs through fake browser-update prompts on compromised websites. After a victim downloads and runs the program, it requests a password and collects browser cookies, Apple Notes and selected password- or cryptocurrency-related files. This case involves executing software, not merely viewing a warning image. Updates should come from the application or its official channel, not an unexpected prompt on an unrelated website. Proofpoint: FrigidStealer.
NimDoor
Report: 2 July 2025; analysis includes an April 2025 incident.
The NimDoor chain uses contact impersonation and meeting invitations to persuade targets to run a fake Zoom update. Multiple components then maintain access and collect information, including Keychain credentials, browser data and Telegram data. The investigated targets were associated with Web3 and cryptocurrency businesses. NimDoor refers to the analyzed malware components; the Zoom-themed lure does not mean the genuine Zoom application contains this malware. SentinelLABS: NimDoor.
MacSync
Report: 22 December 2025. A delivery change in an existing family.
This variant arrived as a digitally signed Swift application that was notarized when examined. A chat-app-themed installer downloaded and executed the information-stealing stage without requiring the victim to paste commands into Terminal. Jamf subsequently reported revocation of the associated signing identity. The case illustrates that signature checks are one protective layer, not an absolute guarantee that every application is safe. Jamf Threat Labs: MacSync.
PamStealer
Report: 2 July 2026. A macOS information stealer.
PamStealer uses an imitation app resembling the Maccy clipboard manager. AppleScript launches a Rust-based next stage, while a deceptive dialog asks for the Mac's login password. The malware checks that password through the system's authentication mechanism and uses it in its data-theft chain. This is an impersonation case, not a finding that the official Maccy project was infected. Jamf Threat Labs: PamStealer.
CloudSyncD
Report: 30 September 2026; samples examined in September 2026.
CloudSyncD hides inside a fake Zoom installer. The package solicits the user's password and installs a backdoor that communicates with its operator's server. Jamf observed samples evolve from development-stage code to a configuration using live control infrastructure. That supports analysis of operational readiness, but does not establish a large victim population. A familiar-looking service name can conceal the program's actual purpose. Jamf Threat Labs: CloudSyncD.
Linux, server and cloud malware
This section covers Linux malware and one server/cloud campaign without a complete operating-system breakdown for its victims. A personal Linux computer and an internet-facing server do not automatically have the same exposure.
Auto-Color
Report: February 2025; samples observed in November and December 2024.
Auto-Color gives attackers remote access to Linux systems. Unit 42's investigation concerned educational and government organizations in North America and Asia. The malware uses inconspicuous names and concealment techniques to support its operation. The initial delivery route was unknown in the first report. The report could not determine whether delivery involved phishing, SSH access or a particular vulnerability. Palo Alto Networks Unit 42: Auto-Color.
Koske
Report: 24 July 2025. A Linux attack chain deploying cryptocurrency miners.
In the Koske case, initial access involved a misconfigured JupyterLab instance. Attackers used a file that could appear to be an image while also carrying code, then executed payloads to conceal activity and mine cryptocurrency. Server computing power was consumed without the owner's permission. This does not mean opening any panda picture infects a computer: the analyzed chain already involved server access and code execution. Aqua Nautilus: Koske.
KSwapDoor
Report updated in December 2025. Observed in React2Shell-related attacks.
KSwapDoor provides remote access, command execution and file management on compromised systems. It establishes communication between machines and imitates a system process. Unit 42 corrected an earlier identification that had pointed to BPFDoor. React2Shell refers to the vulnerability or associated exploitation involving React Server Components, not to a malware family. Not every website built with React has the same vulnerable configuration. Palo Alto Networks Unit 42: KSwapDoor.
VoidLink
Report: 13 January 2026; samples discovered in December 2025.
VoidLink is a modular Linux malware framework that recognizes cloud and container environments. Its components support long-term access and credential collection, including cloud and software-development credentials. In the initial report, however, researchers had not found evidence of real-world infections. This entry documents analyzed samples and capabilities, not a verified widespread outbreak. Check Point Research: VoidLink.
PoeLLM: servers and cloud services
Report: October 2026; activity traced to April 2026.
PoeLLM targets exposed, vulnerable services, including deployments of LiteLLM, Ollama, Gotenberg and Gitea. Compromised systems mine cryptocurrency and scan for further victims. The malware derives its control-server address from words in a poem hosted on GitHub. The report focuses on server services and analyzes an ELF file; it does not provide a victim breakdown by operating system. It does not establish that all installations of those products are infected. Lumen Black Lotus Labs: PoeLLM: servers and cloud services.
Website Malware
On websites, malicious code can live in files, plugins or the database. Some code controls the server; other code changes what visitors receive. A return to a normal appearance is therefore insufficient to establish that the entire infection is gone.
DollyWay
Report: 25 March 2025. A long-running campaign investigated in 2025.
DollyWay uses compromised WordPress websites to redirect visitors to scam destinations. JavaScript and a traffic distribution system determine where visitors are sent. Compromised sites can also become part of the campaign's control infrastructure. Checking only the homepage's appearance is therefore insufficient: a seemingly normal website may still perform malicious functions. DollyWay was not first created in 2025. GoDaddy Security: DollyWay.
Balada Injector and Sign1
2026 report covering 2025 findings. Many detections were remnants of older infections.
GoDaddy recorded residual Balada Injector and Sign1 infections on websites examined during 2025. Balada can leave code and backdoors across multiple WordPress components. Sign1 is associated with malicious code stored in the database through code-management components. The report does not establish continuing new campaigns throughout 2026. Its narrower lesson is that a campaign ending does not automatically remove code already planted on compromised websites. GoDaddy Security: Balada Injector and Sign1.
The fake BelovedPBN plugin
Incident-response report: 16 June 2026. WordPress case.
In this case, a fake plugin injected remote content and planted two webshells using the WordPress database. A webshell is code that gives an attacker management access through the web server. Database storage means a file-only inspection does not cover every hiding place. BelovedPBN here identifies a component in the analyzed incident, not evidence that all SEO-related plugins are malicious. Sucuri: The fake BelovedPBN plugin.
SC WordPress backdoor
Report: 30 September 2026. An infection with mutually restoring components.
Sucuri found interconnected loaders and backdoors spread across files, the database and other WordPress components. Some components can restore deleted parts, making the infection appear to return after partial cleanup. Disguises include plugins and cache-related files. Automatic restoration here describes interaction between components, not a mysterious capability. Finding one malicious file does not mean every attacker access route has been closed. Sucuri: SC WordPress backdoor.
JavaScript injections using JSFireTruck
2025 report. Website campaign; JSFireTruck is a code-obfuscation technique.
Unit 42 investigated malicious JavaScript concealed with JSFireTruck-style obfuscation. The code checks where visitors came from and redirects selected traffic. This explains why opening a URL directly can produce a different result from following a search result. JSFireTruck is not a single malware family, and code obfuscation is not inherently malicious. The harmful elements are the injected code and redirect behavior in the documented campaign. Palo Alto Networks Unit 42: JavaScript injections using JSFireTruck.
Backdoors and loaders after PolyShell
Attacks and payload findings in March 2026. Magento / Adobe Commerce.
PolyShell is a vulnerability, not a malware family. In the associated attacks, Sansec reported server-side backdoors and JavaScript loaders inserted into store content blocks. Investigation therefore needs to distinguish attacker access on the server from code delivered to visitors. The vulnerability's name alone does not identify the installed payload or affected data. Each store's condition requires examination rather than assumptions based only on its platform. Sansec: Backdoors and loaders after PolyShell.
Malware in software packages and build systems
Websites also depend on the tools used to create them. Infection can begin in a package installed by a developer or on a machine that builds an application, before anything is published. These two examples concern the software supply chain.
Shai-Hulud
2025 campaigns, including the wave discussed in November 2025.
Shai-Hulud spreads through compromised npm packages. When malicious installation code runs, it searches for credentials and tokens granting access to development or cloud services. Package-publishing access can help it spread further. Immediate targets can include developers' computers and CI systems, which automatically build or test applications. Visiting a website built by a project is not automatically equivalent to executing its malicious dependency. Palo Alto Networks Unit 42: Shai-Hulud.
ChainDrop
Campaign active since 4 August 2026, according to Unit 42.
ChainDrop uses npm packages to steal credentials and spread further. Relevant targets include npm tokens, GitHub access, SSH keys and cloud secrets. CI machines may also hold valuable application-publishing permissions. Removing an infected package does not address credentials that have already been taken. Response needs to cover the machines that executed it and revocation or replacement of the affected access credentials. Palo Alto Networks Unit 42: ChainDrop.
What to do if you suspect an infection
A list of names helps explain risks, but it cannot diagnose a device from one symptom. Match the response to where the problem appears. Do not download a “cleaner” from the same pop-up that just frightened you.
Android, iPhone, Windows and Mac
- Android: enable Play Protect, check security updates and remove untrusted apps. If symptoms persist, follow the manufacturer's guidance or obtain appropriate technical help. Google's Android guidance.
- iPhone: check for updates through device settings and consult Apple's security releases for official information. A historical report's version range does not replace checking current updates.
- Windows and Mac: review untrusted software and extensions, perform security checks and update the system. On a Mac, do not dismiss an app warning merely because an installer tells you to. See Google's computer guidance and Apple's Mac app guidance.
Servers, cloud environments and development packages
For a server, report the findings to its administrator or security team. Record exposed services, unexplained changes and when symptoms began. Evidence needs to be assessed alongside logs and the system's condition, rather than by a process name alone.
In a package incident, check installed versions and the machines that executed them. Limit token privileges, review application access and use trusted publishing where available. If credentials may have been stolen, replacing a package does not address that access. See GitHub's supply chain security guidance.
WordPress, online stores and other websites
Record affected URLs, times and the conditions under which symptoms appear. For example, does a redirect happen only after a Google visit, or has an unfamiliar administrator account appeared? Preserve available files, database copies and logs before major changes, and coordinate investigation with the hosting provider. WordPress guidance for hacked sites emphasizes documentation, inspection, backups and securing access again.
If Google shows a warning, inspect the Search Console Security Issues report. Request review after addressing the relevant issues. Warning removal and search recovery should not be treated as instant consequences of deleting one file.
To understand the scope before commissioning work, read the website malware removal service explanation. If the concern involves exposed credentials, the data breach monitoring guide covers a different problem from cleaning website code.
Frequently asked questions
Did every malware family in this list first appear in 2025-2026?
No. The list includes newly reported malware, new variants, campaigns involving older families and residual infections. Each entry distinguishes report dates from observed activity. The research cutoff is 18 October 2026.
Can iPhones and Macs get malware?
Yes, but delivery routes vary. SparkCat involves photo access inside apps, while Coruna and DarkSword exploit vulnerabilities in particular iOS versions. Several Mac cases use fake installers or updates. These findings do not mean every Apple device has the same exposure.
Does a compromised website automatically infect a visitor’s phone?
Not necessarily. A compromised site can redirect visitors, display phishing or deliver malicious code. Device infection depends on the payload, user actions, permissions and available vulnerabilities. The website and the visitor’s device require separate assessment.
Is removing a suspicious app or plugin enough?
Not always. Some infections leave additional components or have already stolen credentials. SC WordPress and ChainDrop illustrate why investigation may need to extend beyond one file or package. Recovery depends on the findings and the attacker’s remaining access.
Does this malware removal service also clean Android, iPhone, Windows or Mac devices?
No. The offered service specifically covers website malware investigation and cleanup within an agreed scope. Personal-device malware is discussed here for education. For a website incident, start with the website malware removal service page.
