Hackers Weaponize Trusted Tools to Deploy Notorious Malware

Gbhackers •Mayura Kathir • June 5, 2026

Attackers are leaning harder on legitimate, preinstalled, or widely used system tools to deliver and operate notorious malware families, creating a stealthy, high-velocity threat that outpaces many traditional defenses. The operational logic for attackers is straightforward. Native utilities such as PowerShell, Windows Management Instrumentation (WMI), certutil, mshta, and JavaScript execution contexts already enjoy elevated privileges […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Cybercriminals Exploit Trusted Tools for Malware Deployment Cybercriminals are increasingly using legitimate system tools like PowerShell and WMI to deploy malware, creating stealthy threats that evade traditional defenses. The ANY.RUN Q1 2026 Cyber Risk report highlights a significant rise in loader-based attacks, which nearly doubled, alongside a 14.7% increase in credential theft and a 58.4% rise in Living-off-the-Land techniques. Attackers leverage these trusted tools to establish persistence quickly, with median times of just 21 seconds. This trend complicates detection efforts, as legitimate tools generate benign telemetry that can obscure malicious activity. Organizations are urged to adopt behavioral monitoring and anomaly detection to identify subtle deviations in command usage. The report emphasizes the importance of rapid sandboxing and threat intelligence to mitigate the impact of these attacks. As attackers continue to exploit trusted tools, the need for robust detection and response strategies becomes critical. 4 sources 70

Extracted Entities

Hackers Weaponize Trusted Tools to Deploy Notorious Malware

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (5)

Platforms (1)

Tools (4)