The number of new malicious programs detected every day is around 450,000. That figure comes from AV-TEST Institute, the German research lab that has been counting since 2012. The number has been roughly stable for three years. It is not exploding, even though every vendor wants to tell you it is.
What is changing is the distribution. Old categories of malware, mass-mailing worms, file infectors, autorun exploits, are almost gone. The new normal is quieter, more targeted, and more profitable.
What is actually out there
Three families account for the bulk of what defenders see day to day.
Info stealers, especially those written on top of the Vidar, RedLine, Raccoon, and StealC codebases, are now the most-deployed category of malware on consumer endpoints. They grab browser-stored credentials, crypto wallet files, and session cookies, then exfiltrate to a Telegram or .onion endpoint. They are cheap ($50 to $300 for a build), they are sold as a service, and they are everywhere.
Ransomware loaders have consolidated. The major groups, LockBit (rebuilt after the 2024 takedown), BlackCat/ALPHV (exited-scammed in 2024, re-emerged as “Babuk-Bjorka”), and the Russia-aligned groups that never missed a beat, drive most of the high-impact intrusions. Affiliate programs handle the initial access. The brand handles the leak site and the negotiation. The split is roughly 70/30 in favor of the affiliate, which is why the affiliate model keeps scaling.
Loaders and droppers, written on top of Amadey, IcedID (now Pikabot), and a long tail of small Go and Rust projects, are the initial-access scaffolding. They get onto a host, establish persistence, and then decide what second stage to pull. The second stage is what does the actual damage. The first stage is mostly commodity.
The number that matters more than 450,000
New samples per day is a vanity metric. The number that actually moves is the median time from initial access to data exfiltration, sometimes called “breakout time.”
CrowdStrike’s most recent global threat report puts the median at around 62 minutes for eCrime actors and 79 minutes for nation-state actors. That is the window defenders have to detect, contain, and evict before the attacker establishes a foothold. Sixty-two minutes is brutal. It is shorter than the SLA of most SOCs.
What does that mean in practice? Detection has to happen at the endpoint and the identity layer, because by the time the network layer sees lateral movement, the attacker has been in for a while. Endpoint detection and response (EDR), identity threat detection (ITDR), and a tight email security posture are not optional. They are the only way to be in the game.
What is not a virus
A surprising amount of security marketing treats social engineering as a “virus.” Phishing is not a virus. Business email compromise is not a virus. Credential stuffing is not a virus. These are attacks that do not require malware at all. They ride on legitimate infrastructure, often through legitimate credentials, and the detection signal is behavioral, not signature-based.
Conflating “user got tricked” with “user got infected” is the most common analytical mistake in security reporting. The defenses are different. The costs are different. The response is different. Keep them separate.
Where the threat is going
Three things to watch in the next 12 months.
AI-assisted initial access. Generative models are now being used to write better phishing lures, automate the recon phase, and produce social-engineering pretexts in any language. The volume of low-quality phishing has not changed much. The quality of high-quality phishing has gone up. Spear-phishing used to be expensive. It is getting cheaper.
Identity provider abuse. More attacks are coming through the front door. Session token theft from Okta, Entra, and Google Workspace is now in the top three initial-access vectors. The defender response, mandatory phishing-resistant MFA, short-lived tokens, and detection of impossible travel, is the same as it has been. The attackers know this. They are getting better at not being noticed.
Supply chain via MSPs and SaaS. The number of incidents in the last year that involved a managed service provider or a SaaS vendor as the initial access vector is up sharply. The SolarWinds pattern, with a different cast, keeps repeating. The defender response is the same as it has been: assume third parties are compromised, segment their access, monitor their activity, and have a contractually clean path to revoke.
The boring answer
The boring answer to “are viruses getting worse” is: yes, but not in volume. The total population is roughly stable. What is changing is quality. The samples are more targeted, more patient, and more profitable. The median time to exfiltration is short. Identity is the new perimeter. Third parties are part of your attack surface whether you want them to be or not.
The boring answer is also the one that works. Patch quickly. Use phishing-resistant MFA. Watch the identity layer. Assume third parties are compromised. Have backups that you have actually restored from. None of that is new. All of it is still true.