Episode 211: The Scariest Malware of 2026

 

 

In episode 211 of Cybersecurity Where You Are, Sean Atkinson speaks with Joshua Palsgraf, Sr. Cyber Threat Intelligence Analyst at the Center for Internet Security^® (CIS^®), and Kyle Leonard, Cyber Threat Intelligence Analyst at CIS, about the scariest malware of 2026. From an infostealer that hides its command infrastructure on the Ethereum blockchain to artificial intelligence (AI) agents running chunks of intrusions, they break down what makes malware “terrifying,” why takedowns are getting harder, and what defenders can still do about it.

Here are some highlights from our episode:

• 02:08. The three factors that make malware strains "terrifying"
• 03:39. How the expansion of "as a Service" offerings complicates malware investigations
• 05:10. How member reporting helps to link the stages of an investigation
• 06:31. A move to more automation: Threat actors' use of AI to run chunks of the kill chain
• 07:38. Abuse of trusted applications and services over the development of customized tools
• 10:04. The single scariest malware strain of 2026 and the techniques it uses to earn that title
• 14:45. How an emerging technique calls traditional malware takedown playbooks into question
• 16:21. The challenging, never-ending, and even fun effort of keeping up with new malware
• 22:19. The cost of running a cybercrime operation: “A couple hundred dollars a month”
• 23:38. Real-world examples of threat actors giving more operational control to AI agents
• 26:31. Why essential cyber hygiene still holds sway in defending against the scariest malware
• 29:05. Recommendations for defending against clever malware evasion techniques
• 30:33. The Thing and Facehugger: How these malware names capture today's threat landscape
• 32:48. Looking ahead to 2027: AI as an assistant and infrastructure beyond seizure

Resources

• Multi-State Information Sharing and Analysis Center^®
• CIS Cyber Threat Intelligence Team
• Episode 159: The Scariest Malware of 2025
• SLTT C2 Traffic Tied to Remus Malware Distribution Operation
• ClickFix: An Adaptive Social Engineering Technique
• Episode 124: The Many Layers of a Malware Takedown Operation
• Disrupting the first reported AI-orchestrated cyber espionage campaign
• Inside a Multi-Agent AI Framework Used to Compromise Government Entities in Asia
• Taiwan says it was targeted last month in AI-driven hacking campaign
• Cloudflare deploys protections against php2shell vulnerability
• Real-Time Indicator Feeds
• Living off the Land: Threats Looming From Within

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].