Malware: Top 7 dangerous programmes in 2025

What harm does malware do?

Malware can cause any level of damage: it all depends on imagination of creators of such software, scale of the action and security systems of the victims. These are real virtual worms that parasitise on power of a device and use cyberspace for their own purposes.

Typically, malware is used to:

1. capture the device's power:

• hidden mining;

• unauthorised installation of other types of malware;

• blocking access to websites, updates, including anti-virus software;

• using the device's power to perform planned DDoS attacks.

2. data capture:

• spyware to track usernames, passwords, payment system and bank card data used;

• erasing or encrypting data;

• imposition of advertisements and viral actions to promote goods/services.

3. Internet harm:

• changing device settings;

• installation of virus software that can work even without network connection.

Top 7 malware threats in 2025

Let's look at the anti-rating for 2025.

SocGholish

The leader among malware in 2025. It accounts for about 60% of all security incidents. It is JavaScript framework that spreads through phishing sites, spam ads and other sources. SocGholish prefers to masquerade as useful software or software update requirements (e.g., browser updates).

Negative impact: collecting sensitive data from the infected device (using Cobalt Strike technology), getting unauthorised access to the system (NetSupport remote access tools, less often Async), downloading ransomware.

Lumma Stealer

Lumma Stealer malware is a newcomer that has rapidly broken into the 2025 Anti-Rating. It is powerful infostealer specialising in stealing users' confidential information: logins, passwords, bank card data, cryptocurrency wallets and other sensitive information. It spreads via phishing emails, infected attachments and malicious websites.

As of Spring 2025, Lumma has infected more than 394,000 devices worldwide, making it the object of international operation to eradicate it.

Negative impact: the programme invisibly infiltrates into the system and sends full dump of user data to attackers within minutes. This poses threat of account hacking, money theft and complete loss of digital privacy.

ArechClient2

At the end of 2023, the number of infections with the Arechclient2 (SectopRAT) malware increased significantly. This is classic trojan that supports remote access and administration functionality (NET RAT). It was distributed via the Brave Browser (most often), Tor, Signal, and Telegram search engine pseudo-updates. This malware accounts for about 9% of all security incidents.

Negative impact: most often ArechClient2 tries to collect users' confidential information, including payment data (banking, crypto wallet passwords), and can also run hidden desktop to control browsers. It has a fairly high degree of protection against security programmes.

Agent Tesla

Agent Tesla is another example of the trojan that is the 3rd most widespread in the world. It supports the RAT remote access format. It was created in 2014, mainly favours Windows users as victims. The program is paid, it can be purchased on specialised websites for $15-20.

Negative impact: extensive opportunities to obtain your data, depending on the version purchased, including capturing keystrokes and screenshots, collecting stored credentials from web browsers, accessing Bitcoin wallet data, copying clipboard data, deleting victim files, and downloading other malware to host.

CoinMiner

The fourth place in our anti-rating is occupied by CoinMiner hidden mining software. The malware uses  power of the infected device to mine cryptocurrency. As a rule, easy-to-mine coins like Litecoin (LTC) and Monero (XRM) are chosen. The main source of distribution is spam emails.

Negative impact: crypto mining is  very energy intensive process. The performance of the machinery is always at 100%, there is increased amortisation and high energy costs.

NanoCore

Fifth place is occupied by a sophisticated stage two malware classified as the NanoCore Remote Access Trojan (RAT). The trojan provides attackers with ability to remotely execute code (RCE) on the victim's system.

Negative impact: the main negative impact is file theft, keystroke logging, screenshots and other hardware usage such as webcam and microphone monitoring.

New RAT threats

The year 2025 will see the surge in Remote Access Trojans (RATs) and malicious campaigns masquerading as software updates. These include FakeUpdates (aka SocGholish), AsyncRAT, and the Clop encryptor. What these threats have in common is their high degree of disguise, heavy use of social engineering tricks and ability to scale in enterprise environments. FakeUpdates spreads via fake browser updates and attacks predominantly through infected websites. AsyncRAT and its counterparts give attackers full remote control over the system, including screen, key and webcam recording. Clop, on the other hand, is actively used in attacks on businesses to extort large sums of money.

Negative impact: from remote espionage and corporate data theft to full encryption of critical information with subsequent ransomware. These threats are actively evolving and modifying, bypassing traditional antivirus solutions.