Malware has surpassed phishing as the top DNS-based threat in the first half of 2026, moving from fourth place in the second half of 2025 to first in just six months. It is one of the main conclusions of the H1 2026 DNS Threat Intelligence Report, the new EfficientIP report prepared from the analysis of more than 150,000 million daily DNS transactions.
Daily malware activity quadrupled between January and April, going from a low of 8.0 million daily detections to a peak of 32.6 million, and remained near that level through June. Overall, the total volume of DNS threat signals grew by 24% compared to the second half of 2025, from 11.18 billion to 13.85 billion detections. Malware, for its part, almost doubled in the same period, reaching 3.84 billion detections, and accounted for a good part of that overall increase.
The attackers prepared the infrastructure
The report also identifies a clear sequence in the DNS data that allows us to see how the attackers were preparing the infrastructure for the malware outbreak weeks before its activation. In February, the activity of domain generation algorithms, known as DGA, was the first sign, with a monthly growth of 24.2%.
In March, newly observed domains increased by 56.8% and malicious activity began to accelerate, increasing by 73.1%. In April, both signals peaked simultaneously: newly observed domains grew by another 92.1% and malicious activity by 86.8%, coinciding with the malware peak of the semester.
The report also analyzes several families of domain generation algorithms and shows that some malicious infrastructures can continue to generate activity even after domain registrations expire or after periods of apparent inactivity. For EfficientIP, this behavior confirms that the sudden drop of a campaign or the expiration of a domain does not necessarily eliminate the risk, which is why monitoring DNS activity is key to anticipating possible threats.
Messaging deserves special attention
At the same time, phishing shows relevant changes. Its overall volume was down 10% in the first half of 2026, but targets changed noticeably across sectors. Logistics and courier brands moved from seventh to third place among the most attacked sectors, with their share of detections increasing 3.4-fold, from 4.0% to 13.6%, driven largely by a single active campaign that emerged in late June.
Phishing shows relevant changes since its overall volume decreased by 10% in the first half of 2026
With shipping volumes set to increase, EfficientIP’s report notes that delivery and courier-related honeypots deserve special attention from security teams in the coming months.
“The rise of malware to the top of the threat landscape should be a red flag for all security teams,” said Karim Hossen, R&D Manager and CISO at EfficientIP. “Suspicious DNS activity can reveal your infrastructure weeks before an attack unfolds, allowing you to investigate and act in advance.”
