Skip to content
Malware Activity Quadruples, Overtakes Phishing as Leading DNS Threat

Malware Activity Quadruples, Overtakes Phishing as Leading DNS Threat

First seen 7 Oct 2026, 15:57 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 7, 2026 at 18:57 UTC
  • •Malware activity quadrupled, reaching 32.6 million daily hits in April 2026.
  • •Malware has overtaken phishing as the leading DNS threat category.
  • •DGA activity serves as an early warning signal for upcoming malware surges.

EfficientIP's H1 2026 DNS Threat Intelligence Report reveals that malware activity has surged, quadrupling since January and surpassing phishing as the top DNS-based threat. Daily malware activity increased from 8 million hits in January to 32.6 million in April, with a total of 3.84 billion hits recorded in H1 2026. The overall DNS threat signals rose by 24% from H2 2025, indicating a significant escalation in cyber threats. The report highlights that domain-generation algorithm (DGA) activity served as an early warning signal, with notable increases in DGA activity observed in February, followed by a spike in newly observed domains in March and April. The findings emphasize the evolving threat landscape, with logistics and courier phishing also seeing a 3.4x increase, moving from seventh to third place among threats. EfficientIP analyzed over 150 billion DNS transactions to compile these insights.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-01-01
Malware activity at 8 million hits
Malware activity recorded a low of 8.0 million hits per day in January 2026.
Finance.Yahoo
2026-02-01
DGA activity increases
Domain-generation algorithm (DGA) activity rose 24.2% month over month, indicating new infrastructure was coming online.
Finance.Yahoo
2026-03-01
Newly observed domains spike
Newly observed domains increased by 56.8%, with malicious activity accelerating by 73.1%.
Finance.Yahoo
2026-04-01
Malware activity peaks
Malware activity peaked at 32.6 million hits per day, coinciding with a 92.1% rise in newly observed domains.
Finance.Yahoo

More articles in this cluster (3)

Following this threat?

Track BaitHook and Education in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (12)

1 / 2

Common questions

What is the current malware activity level?
Malware activity peaked at 32.6 million hits per day in April 2026, up from 8 million in January.
How does DGA activity relate to malware surges?
DGA activity serves as an early warning signal, showing increased momentum weeks before malware activity spikes.
What other threats are increasing?
Logistics and courier phishing has increased by 3.4 times, moving from seventh to third place among threats.