7 Tricky Types of Malware to Watch Out For

The word "malware" still conjures up a dodgy email attachment called invoice.exe and an antivirus pop-up that saves the day. That picture is about fifteen years out of date. Most of what's hitting businesses now is quieter, faster, and built specifically to slip past the tools that caught the old stuff.

Here's a number that resets expectations. When Microsoft and the US Department of Justice took down the Lumma infostealer in May 2025, Microsoft reported it had found Lumma on roughly 394,000 Windows computers in the two months before the takedown. Divide that by 61 days and you get about 6,500 new infections a day, or between four and five every minute. That's one malware family, and it wasn't the only one on the market.

So let's go through the seven types worth knowing about, what each actually does, and the control that blunts it.

1. Infostealers: malware that wants your logins, not your files

An infostealer doesn't encrypt anything or demand money. It runs for a few seconds, scoops up everything your browser has saved (passwords, credit cards, autofill data and, most importantly, session cookies) and sends the lot to its operator. Then it often deletes itself.

The session cookies are the prize. A cookie is the token that tells Microsoft 365 or your bank "this person already signed in and passed MFA". Copy it to another computer and the attacker is signed in as you, no password or MFA prompt required. The stolen data is then sold in bundles called "logs" on criminal markets, which is how a single infected home PC can become a business breach months later.

What stops it: don't let staff save work passwords in the browser, use a proper password manager, and configure Microsoft 365 so sessions are tied to managed, compliant devices. We explain the cookie-theft side in unexpected ways hackers get into accounts.

2. ClickFix: the fake CAPTCHA that makes you install it yourself

This one is clever in a deeply annoying way. You land on a compromised website and get what looks like a Cloudflare "verify you're human" box. Except the instructions are odd: press Windows + R, then Ctrl + V, then Enter.

What's happened is the page has silently copied a PowerShell command to your clipboard. Those three keystrokes open the Run box, paste the command and execute it. Because you ran it, there's no download warning and no SmartScreen prompt. The command usually fetches an infostealer. Microsoft has since documented variants that use Windows Terminal instead of the Run box, which tells you how well the original worked.

What stops it: mostly training. No legitimate website will ever ask you to paste something into Windows to prove you're human. Technically, blocking PowerShell for standard users and using application control (one of the ACSC's Essential Eight) cuts it off. It's a good example of why user awareness training needs to cover current tricks, not just "don't open attachments".

3. Fileless malware: living off the land

Traditional antivirus works a bit like a bouncer with a list of photos: it compares files against known-bad fingerprints. Fileless malware avoids leaving a file to photograph. It runs in memory and borrows tools that are already on every Windows machine, such as PowerShell, WMI and the built-in scheduler, to do its work. Security people call this "living off the land".

The problem for defenders is that PowerShell is also what your IT provider uses to manage the machine. You can't just delete it. You have to tell the difference between normal use and malicious use, which is a behaviour problem, not a file problem.

What stops it: endpoint detection and response (EDR), which watches what processes do, plus someone actually watching the alerts. That's the job of managed detection and response.

4. Polymorphic and AI-assisted malware

Polymorphic malware changes its own code each time it spreads, so the fingerprint never matches twice. It's an old idea, but generative AI has given it a new twist. In November 2025 Google's threat intelligence team described an experimental malware family it named PROMPTFLUX, which called Google's own Gemini model and asked it to rewrite the malware's source code, in one version every hour, to dodge antivirus.

To be fair to the facts, Google said the samples looked like a work in progress and it disabled the accounts involved. But the direction is clear. Malware that asks a chatbot to help it hide... look, somebody built that on purpose. We can make the models better at writing code. Whether everyone using them has, uh, good intentions is another matter.

What stops it: the same behaviour-based EDR as above. A rewritten program still has to do something malicious eventually, and that's where it gets caught.

5. Ransomware that steals first and encrypts second

Ransomware has become a two-stage business. Attackers copy your data out first, then encrypt your systems. If you restore from backup and refuse to pay, they threaten to publish what they took. Some groups skip the encryption entirely and just extort.

This is why "we have backups" is no longer a complete ransomware plan. Backups fix the encryption; they do nothing about the leak. In Australia, a stolen copy of customer data can also trigger the OAIC's Notifiable Data Breaches scheme, and businesses with turnover over $3 million that pay a ransom must now report the payment to the ASD within 72 hours.

What stops it: limiting how far an attacker can move once inside (MFA everywhere, no shared admin accounts, restricted admin rights), plus backups that are immutable and tested. Our guide to secure data backup covers the recovery half.

6. Supply-chain worms

Why break into a thousand businesses when you can break into the software they all install? In September 2025 researchers found a self-replicating worm, nicknamed Shai-Hulud, spreading through npm, the public library of JavaScript packages that developers rely on. When a developer installed an infected package, it hunted for their publishing credentials and used them to inject itself into other packages that developer maintained. Hundreds of packages were compromised, and a second wave followed in November.

If you don't write software, this feels remote. It isn't. The apps and plug-ins your business uses are built from these libraries. The same logic applies to the browser extensions and connected apps your staff add to Microsoft 365.

What stops it: keeping an inventory of the software and integrations you rely on, and vetting new ones before they get access. Our checklist for vetting third-party apps is a good starting point.

7. Mobile malware dressed up as useful apps

Phones now hold the MFA codes, the banking app and the work email, which makes them a better target than the laptop in some cases. The usual delivery is a fake app: a parcel-tracking tool linked from a text message, or a "security update" that asks for accessibility permissions. Once granted, those permissions let malware read the screen and tap buttons on your behalf.

What stops it: install apps only from the official stores, never grant accessibility permissions to an app that doesn't obviously need them, and manage work phones properly. We go deeper in what to do about mobile malware.

The common thread

Notice what most of these have in common: they're designed to beat signature-based antivirus, and several of them work by getting a person to do the risky step. That points to the same three-part defence every time. Behaviour-based endpoint protection that someone monitors. Controls that limit damage when something gets through, like the Essential Eight. And staff who recognise a fake CAPTCHA when they see one.

If you're not sure which of those you already have, a cyber security assessment will tell you, in plain English, where the gaps are.

Frequently asked questions

What is the most common type of malware right now?

For businesses, infostealers are among the most widespread, because the credentials and session cookies they steal are resold and used for account takeover and ransomware. They're often delivered through fake downloads, malicious ads and fake CAPTCHA pages.

Can antivirus detect fileless malware?

Traditional signature-based antivirus often can't, because there's no malicious file to scan. Endpoint detection and response tools catch it by spotting suspicious behaviour, such as Office spawning PowerShell or a script connecting to an unknown server.

What is a ClickFix attack?

ClickFix is a social engineering trick where a fake CAPTCHA or error message tells you to press Windows + R, paste and press Enter. That runs a hidden command the website copied to your clipboard, usually installing malware. No legitimate site asks you to do this.

How do I protect my business from new malware?

Use behaviour-based endpoint protection with monitoring, keep systems patched, enforce MFA, restrict admin rights and application installs, keep immutable tested backups, and train staff on current tricks. The ACSC's Essential Eight is a sound framework to work through.

Local IT and cyber security support across NSW

Chewing IT runs managed IT and cyber security for small and mid-sized businesses from our Wyong and Hornsby offices, covering the Central Coast, Newcastle, Lake Macquarie and Hornsby.

Want to know whether your current antivirus would catch any of these? Talk to us about a security review — we'll check your endpoints and tell you what's missing.