H1 2026 Malware Vulnerability Trends

Insikt Group / Recorded Future’s H1 2026 intelligence summary documents a rise in active exploitation and adversary reliance on legitimate tools and trusted workflows: 215 actively exploited CVEs (many network-accessible and unauthenticated RCEs), pervasive RATs and stealware (AsyncRAT, Cobalt Strike, XWorm, REMCOS), supply-chain compromises of package managers and developer tooling (e.g., npm, GitHub, AI-enabled tools), increasing NFC-enabled mobile banking fraud, Magecart skimming via third-party services, and early AI-assisted malware workflows — concluding with prioritized mitigations for exposure management, developer-credential protection, behavioral detection, and backup resilience.