Malware decreased in May 2026, but URL attacks and ransomware groups remain a high threat

Acronis Cyberthreats Update June 2026 shows almost 1.2 percent more blocked URL attacks than the previous month and over 770 publicly reported data breaches.

In May 2026, malware was detected on 6.2 percent of users monitored by Acronis [1], a decrease of 0.6 percentage points compared to April (6.8 percent). However, the number of blocked URL attacks increased by almost 1.2 percent, indicating that Acronis does not see any overall improvement in the global threat landscape. In addition, over 770 data breaches were publicly reported during the month.

Acronis Cyberthreats Update provides a monthly up-to-date overview of the threat landscape as well as analyses from the experts at Acronis Threat Research Unit (TRU), to help businesses and individuals protect themselves against an ever-changing cybersecurity threat.

The number of blocked URL attacks increased by almost 1.2 percent in May 2026 compared to the previous month. However, the trend for endpoint detections went in the opposite direction. The share of users registered by Acronis where at least one malware was detected and blocked decreased by 0.6 percentage points, from 6.8 percent in April to 6.2 percent in May. At the same time, over 770 data breaches were publicly reported in May, compared to 789 in April.

The three most common threats detected during May were IoT botnet malware Mirai, as well as the information thieves FormBook and AgentTesla. Both Mirai [2] and AgentTesla [3] have been among the most frequently detected threats during the year. Among the ransomware groups, Qilin again the most active, with 111 registered victims in May. Also Gentlemen and DragonForce remained at high levels with 89 and 55 victims respectively [4].

Additional results

• In Germany, the normalized detection rate for malicious URLs decreased from 11.1 percent in April to 10.7 percent in May, while levels were higher in Singapore (13.1 percent), Brazil (13.0 percent) and Colombia (12.7 percent), among others.
• The largest increase in malicious URLs was recorded in New Zealand, where the detection rate rose by 3.3 percentage points, from 9.4 to 12.7 percent. South Korea saw the largest decrease, by 2.6 percentage points, from 8.5 to 5.9 percent.
• The highest normalized malware detection rates globally were once again recorded in Palestine (45.5 percent), Vietnam (32.2 percent), and Iraq (27.4 percent).

– The fact that malware detections decreased again in May after the peak in April is a positive development, but it should not be interpreted as a sign that the threat landscape has fundamentally eased, says Markus Fritz, General Manager DACH at Acronis. The threat landscape remains above year-earlier levels, with blocked URL attacks continuing to increase and ransomware groups remaining highly active. Organizations should therefore employ a multi-layered defense that combines endpoint security, advanced email and URL filtering, and behavioral detection with AI and machine learning.

Recommendations for protecting yourself against today's threats

• Use strong and unique passwords along with a password manager.
• Store sensitive files in encrypted cloud storage.
• Introduce automated recovery of encrypted or manipulated files, for example with Acronis Cyber Protect Cloud [4].
• Use advanced email protection and URL filtering to reduce the risk of phishing and other forms of social engineering.
• Ensure effective patch management so that software is always up to date.
• Check signed installation files, not only the digital signature but also the configuration data the files contain.
• Review the use of remote access software and limit it to necessary uses.
• Implement a robust security solution that Acronis Cyber Protect Cloud [4], with behavioral analysis, AI, machine learning, and anti-ransomware capabilities.

The complete Acronis Cyberthreats Update for June 2026 is available at:
www.acronis.com/en/tru/posts/acronis-cyberthreats-update-june-2026/

About Acronis

Acronis is a global cybersecurity company that offers the industry's only natively integrated cybersecurity, data protection, and infrastructure management platform for managed service providers (MSPs) and IT departments. Acronis solutions help organizations identify and protect their IT environments, detect and manage threats, and recover and manage data to ensure data integrity and business continuity.

Acronis is a Swiss company founded in 2003 in Singapore. The company has 15 offices worldwide and employees in more than 60 countries. Acronis Cyber Platform is available in 26 languages in over 150 countries and is already used by more than 21,000 service providers to protect over 750,000 organizations worldwide.

More information is available at: www.acronis.com.