Point Wild’s Q2 2026 Report Highlights Malware and Identity-Theft Trends
Report discovered via Awesome Annual Security Reports.
Summary
Point Wild’s Q2 2026 report analyzes malware, ransomware and supply-chain activity using internal research, detection telemetry and public sources. It highlights prevalent Trojans, credential-focused infostealers and regional and industry trends.
Key points
- The report says Trojans accounted for 45.4% of detections and infostealers for 20.9% during Q2 2026.
- It describes infostealers as targeting browser credentials, session cookies, authentication tokens and cloud account data, which can enable account access and further attacks.
- Point Wild reports sustained XWorm activity and says version 7.4 introduced encrypted C2 communications and an updated plugin architecture.
- Point Wild’s reverse-engineering team documented a Vidar campaign using a multi-stage infection chain, trusted Windows utilities and memory-based execution.
- The report identifies Qilin as a prominent ransomware group and says its victim figures are based on public claims that may not reflect verified compromises.
- It describes supply-chain activity targeting open-source packages, developer accounts and CI/CD credentials, with potential downstream effects.
- The report’s regional and industry findings draw on publicly reported incidents and threat intelligence, so they may not represent all global activity.
Article Details
- Publisher
- Point Wild; prepared by Lat61 Threat Intelligence Team
- Report Period
- 2026-04 to 2026-06
- Scope
- Malware and cyber threat activity observed through Point Wild research, reverse engineering, detection telemetry, and public threat intelligence.
- Key Statistics
- Trojans accounted for 45.4% of malware detections in Q2 2026; infostealers accounted for 20.9%.
- Observed malware and ransomware activity was distributed across North America (40%), Europe (25%), Asia-Pacific (20%), South America (8%), and the Middle East & Africa (7%).
- The report says Business Services, Manufacturing, and Healthcare collectively accounted for nearly three-quarters of reported incidents; no exact percentage is provided.
- Recommendations
- Prioritize identity protection for credentials, authentication tokens, and cloud identities.
- Improve endpoint visibility and continuously monitor for emerging threats.
- Strengthen software supply chain security.
- Maintain rapid incident response capabilities.
MITRE ATT&CK
T1195 · Supply Chain CompromiseThe report describes compromised software packages and dependencies used to compromise downstream organizations.T1539 · Steal Web Session CookieThe report says infostealers steal session cookies.T1555.003 · Credentials from Web BrowsersThe report says infostealers collect credentials stored in web browsers.T1566 · PhishingThe report describes phishing campaigns as a distribution method for XWorm and Vidar.
Threat Actors
Malware
AgentTeslaIn the wild, the most prominent infostealer families in Q2 2026 are Lumma, RisePro, Vidar, StealC, RedLine, AgentTesla, and Formbook.FormBookIn the wild, the most prominent infostealer families in Q2 2026 are Lumma, RisePro, Vidar, StealC, RedLine, AgentTesla, and Formbook.LummaIn the wild, the most prominent infostealer families in Q2 2026 are Lumma, RisePro, Vidar, StealC, RedLine, AgentTesla, and Formbook.RedLineIn the wild, the most prominent infostealer families in Q2 2026 are Lumma, RisePro, Vidar, StealC, RedLine, AgentTesla, and Formbook.RiseProIn the wild, the most prominent infostealer families in Q2 2026 are Lumma, RisePro, Vidar, StealC, RedLine, AgentTesla, and Formbook.StealCIn the wild, the most prominent infostealer families in Q2 2026 are Lumma, RisePro, Vidar, StealC, RedLine, AgentTesla, and Formbook.Vidar- [3.2. Infostealers / Vidar](#32-infostealers--vidar)XWorm- [3.1. Remote Access Trojans / XWorm](#31-remote-access-trojans--xworm)
Countries
Industries
business servicesAnalysis of publicly available threat intelligence reports and disclosures for Q2 2026 shows that Business Services, Manufacturing, and Healthcare were the most targeted industries, collectively accounting for nearlyFinancial ServicesFinancial Services, Power & Energy, and Government also remained key targets, reflecting adversaries’ continued interest in sectors where operational disruption and financial impact are highest.GovernmentFinancial Services, Power & Energy, and Government also remained key targets, reflecting adversaries’ continued interest in sectors where operational disruption and financial impact are highest.HealthcareThe USA continued to bear the heaviest global impact, while Healthcare, Manufacturing, and IT sectors remained the most frequently targeted industries.ITIt spread rapidly through phishing campaigns and the widespread circulation of cracked builds, gaining adoption among both low-skilled threat actors and advanced persistent threat (APT) groups.ManufacturingThe USA continued to bear the heaviest global impact, while Healthcare, Manufacturing, and IT sectors remained the most frequently targeted industries.Power & EnergyFinancial Services, Power & Energy, and Government also remained key targets, reflecting adversaries’ continued interest in sectors where operational disruption and financial impact are highest.Softwarefrom traditional system exploitation to identity compromise, sophisticated malware, ransomware, and software supply chain attacks.