Top 10 Malware Q3 2025

Total malware notifications from Multi-State Information Sharing and Analysis Center^® (MS-ISAC^®) monitoring services increased 38% from Q2 to Q3 2025. SocGholish continues to lead the Top 10 Malware as it has for the past two years, comprising 26% of detections. SocGholish is a downloader written in JavaScript that is distributed through malicious or compromised websites via fake browser updates. SocGholish infections often lead to further exploitation, such as NetSupport and AsyncRAT remote access tools. CoinMiner, a cryptocurrency miner, and Agent Tesla, a remote access trojan (RAT), followed SocGholish.

In Q3 2025, the MS-ISAC also observed the return of Gh0st, Lumma Stealer, and TeleGrab, while Jinupd made its first appearance. Jinupd is a downloader that uses obfuscated scripts to fetch and execute additional payloads. It is typically distributed via phishing campaigns and compromised websites.

Additionally, this is Lumma Stealer’s first appearance after law enforcement took down its infrastructure. Lumma Stealer is an infostealer malware sold on the dark web that targets personally identifiable information (PII), such as credentials and banking information. It also has numerous defense evasion capabilities, including detecting whether the infected system is a virtual environment, detecting user activity on the system, and encrypting its executable to prevent reverse engineering

Malware Infection Vectors

The MS-ISAC tracks potential initial infection vectors for the Top 10 Malware each quarter based on open-source reporting, as depicted in the graph below. We currently track three initial infection vectors: Dropped, Malspam, and Malvertisement. Some malware use different vectors in different contexts, which are tracked as Multiple.

• Dropped: Malware delivered by other malware already on the system, an exploit kit, infected third-party software, or manually by a cyber threat actor. Gh0st used this technique at the time of publication.
• Malspam: Unsolicited emails, which either direct users to malicious websites or trick users into downloading or opening malware. Agent Tesla used this technique at the time of publication.
• Malvertisement: Malware introduced through malicious advertisements. SocGholish and ZPHP used this technique at the time of publication.
• Multiple: Malware that currently uses at least two vectors, such as Dropped and Malspam. CoinMiner, Jinupd, Lumma Stealer, NanoCore, TeleGrab, and VenomRAT used this technique at the time of publication.

The CIS Community Defense Model (CDM) v2.0 can help you defend against 77% of MITRE ATT&CK (sub-)techniques associated with malware regardless of the infection vector they use. Learn more in the video below.

In Q3, Multiple was the number one initial infection vector due to an increase in alerts related to CoinMiner, TeleGrab, and VenomRat.

Top 10 Malware and IOCs

Below are the Top 10 Malware listed in order of prevalence. The CIS CTI team provides associated Indicators of Compromise (IOCs) to aid defenders in detecting and preventing infections from these malware variants. Analysts sourced these IOCs from threat activity observed via CIS Services^® and open-source research. Network administrators can use the IOCs for threat hunting but should vet any indicator for organizational impact before using for blocking purposes.

1. SocGholish
2. CoinMiner
3. Agent Tesla
4. TeleGrab
5. ZPHP
6. VenomRAT
7. Gh0st
8. NanoCore
9. Lumma Stealer
10. Jinupd

1. SocGholish

SocGholish is a downloader written in JavaScript and distributed through malicious or compromised websites via fake browser updates. It uses multiple methods for traffic redirection and payload delivery, commonly uses Cobalt Strike, and steals information from the victim’s system. Additionally, SocGholish can lead to further exploitation, such as loading the NetSupport and AsyncRAT remote access tools or even ransomware in some cases.

Domains

billing[.]roofnrack[.]us
cpanel[.]365axissolution[.]com
email[.]directoryindustry[.]com
feedback[.]fortunetaxs[.]com
folders[.]emeraldpinesolutions[.]com
keynotecapitals[.]com
photo[.]suziestuder[.]com
zone[.]ebuilderssource[.]com

2. CoinMiner

CoinMiner is a cryptocurrency miner family that typically uses Windows Management Instrumentation (WMI) to spread across a network. Additionally, it often uses the WMI Standard Event Consumer scripting to execute scripts for persistence. However, the malware’s capabilities vary, as there are multiple variants. CoinMiner spreads through malspam or is dropped by other malware.

SHA256 Hashes

063A65D2D36CAE110D6D6C400956A125B9C35176D628A9A8F4D8E2133EC4D887
0338C2CC1E83C851ADAA3EBB836A40B849DF0C48060BD3086193542CC6A7F26C
118AE6110A4B5708433EBD5809682E8C30F281F459A3B92B3E8ADA5023EB6640
3E59379F585EBF0BECB6B4E06D0FBBF806DE28A4BB256E837B4555F1B4245571
47ecaab5cd6b26fe18d9759a9392bce81ba379817c53a3a468fe9060a076f8ca
59F7C03A2021CB28A433AE0D018388B2A5B802686CA94699FA0BC9E1917AEAD0
9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507

3. Agent Tesla

4. TeleGrab

5. ZPHP

6. VenomRAT

7. Gh0st

8. NanoCore

9. Lumma Stealer

Lumma Stealer, also known as Lumma, is an infostealer malware that operates as a Malware as a Service. It targets PII, such as credentials, banking information, cookies, browser autofill data, and cryptocurrency wallet information. Additionally, it has numerous defense evasion capabilities, including virtual environment detection, user activity monitoring, and executable encryption to hinder reverse engineering.

Domains

lzh[.]fr
digitbasket[.]com
duhodown[.]fun
kowersize[.]fun
marvelvod[.]com
mouseoiet[.]fun
plengreg[.]fun
zamesblack[.]fun
zamesblack[.]fun

SHA256 Hashes

FA8BE0CE6F177965A5CD2DB80E57C49FB31083BD4DDCB052DEF24CFBF48D65B5
388F910E662F69C7AB6FCF5E938BA813CF92C7794E5C3A6AD29C2D9276921ED3
64F6C0C0FD736C4A82F545AADC7A1C49D4CEA77B14F4B526EF9DA56A606EEB3D

10. Jinupd

This threat intelligence briefing illustrates how the CIS CTI team supports paid members of the MS-ISAC. Available to U.S. State, Local, Tribal, and Territorial (SLTT) government entities, MS-ISAC membership enables organizations to share information and collaborate on defending against cyber threats. The CIS CTI team supports members by maintaining the only STIX/TAXII threat intelligence feed tailored to U.S. SLTTs. It also routinely releases threat intelligence briefings along with detailed reports, such as the Quarterly Threat Report and Operational Cyber Analytic Report, to provide decision-makers with actionable threat intelligence they can use to take a proactive approach to their organization’s cyber defense.

Ready to augment your cybersecurity posture using the expertise of the CIS CTI team?