AVLab.pl Advanced In-The-Wild Malware Test - September 2025

Disclaimer
  1. This test shows how an antivirus behaves with certain threats, in a specific environment and under certain conditions.
    We encourage you to compare these results with others and take informed decisions on what security products to use.
    Before buying an antivirus you should consider factors such as price, ease of use, compatibility, and support. Installing a free trial version allows an antivirus to be tested in everyday use before purchase.

Social engineering.

I knew a man, passed away a few years ago, he was a senior citizen and a buddy of mine. He was older, and not so great with Tech. I taught him the basics, set up security and ad blocker and password manager for him. Gave him a few lessons on what to look for and how to make backups of his important items. He did these things and had no issues with malware even at his age. Where he fell short, was a phone call stating that the caller was from Microsoft and they detected a problem on his system. They talked him into installing the necessary remote session software and allowing them into his system, where they found loads of problems and needed to charge him $400. At this point his system started acting up as they gutted it. He hung up on them and called me, said hey, I think I just messed up, I asked what happened, he stated, Microsoft called me, I told him enough said as I knew exactly what just happened without him finishing. I went down there, got into the system, severed the remote connection, and began to repair the damaged system. Then I grabbed his phone, looked through the logs, and called the scammers back. I asked the scammer, do you not have a conscience. At this point the scammer stated, no, it's so easy to do, you Americans are so ignorant and gullible.

Thr moral of the story, even with proper guidance and security one Skip of judgment by the "people" has its effects. It's all it takes. As stated for the most part, people are the problem. Being uninformed is the biggest aspect of that problem, the other is not caring and thinking you can do whatever you want on the web and are untouchable.

Develop good habits, enforce those habits, use deliberate caution when approaching anything. Keep backs up a frequent routine. Stop relying on software to save you from yourself. Software is the last line of defense past all that you do to prevent issues. Which leads to last but not least, quit relaxing those habits because you have software, it's not a bullet proof vest.
 
Last edited by a moderator:
Yes, why?

Would you like us to provide evidence for each sample? Do you really think the results are made up on the fly?

We are required to provide evidence for each sample, and we do so in several ways:

  • antivirus logs
  • Sysmon logs (rules to detect Webroot's response to malware)
  • a screenshot of each PRE or POST_Launch detection
  • extracting words from an image as OCR (image-to-text conversion)
  • Sysmon logs for malicious actions of each sample

CSV extract for the Webroot (a piece):

View attachment 293744

Additionally, see how many requirements we have to meet to comply with AMTSO: https://avlab.pl/en/wp-content/uploads/2025/09/AMTSO-Compliance-Confirmation-AVLab-July-2025.pdf

We, as a Lab, are evaluated by each software developers for each edition of the test.

Example of a screen for stopping malware at the PRE stage while downloading in Opera:

View attachment 293746

And another:

View attachment 293749

Example at the POST level:

View attachment 293747

An another example:

View attachment 293748

A piece of Sysmon tree:

View attachment 293751
Adrian i meant no doubt of the efficacy of your testing . my comment was badly put. i have used webroot myself with no issues. i was simply asking the forum how they would react to their doubts about webroot vs your findings . Sincere apologies ... i meant no disrespect . your organisation seems to be one of the few that actually tests webroot and i follow avlabs because of this fact . members have been enlightening about the intricacies of these tests and that has been v helpful too. keep testing . kind regards .
 
Over the past decade, North Americans have faced steadily rising rates of digital device infections, identity theft, and financial losses from cybercrime. Malware infections have surged globally, identity theft reports have more than doubled, and financial losses in the U.S. alone have climbed from under $3 billion in 2015 to over $16 billion in 2024.

📊 Ten-Year Trends in North America​

Category2015–20172018–20202021–20222023–2024Key Notes
Digital Device InfectionsBillions of malware detections globally (~5B/year) deepstrike.ioSlight dip during pandemic (~5.4B in 2021) deepstrike.ioStabilized (~5.5B in 2022) deepstrike.ioSharp rise: 5.8B (2023), 6.2B (2024) deepstrike.ioMobile malware surged; Android devices 50× more likely to be infected than iOS deepstrike.io
Identity Theft Reports (U.S.)~2.6M reports in 2014 Security.org~3.5M reports in 2019 Security.org~4.7M reports in 2022 IdentityTheft.org5.7M reports in 2024; 1.4M were identity theft IdentityTheft.orgIdentity theft cases grew ~85% over the decade Security.org; most common type: credit card fraud ConsumerAffairs
Financial Losses (Cybercrime, U.S.)~$1.1B losses in 2015 Statista~$2.7B losses in 2018 Statista~$6.9B losses in 2021 IdentityTheft.org$12.5B losses in 2023 Statista; $16B losses in 2024 FBI Security.orgInvestment fraud & business email compromise caused largest losses Statista

🔑 Key Insights​

  • Device Infections: Malware infections remain pervasive, with over 6 billion detections annually by 2024. The rise of IoT and AI-driven malware has accelerated infection rates deepstrike.io.
  • Identity Theft: The FTC reports identity theft cases nearly tripled in the past decade, with a new victim every 22 seconds in 2025 IdentityTheft.org. Credit card fraud dominates, but government benefits and bank transfer fraud are increasingly costly ConsumerAffairs Security.org.
  • Financial Losses: Cybercrime losses in the U.S. grew more than 5× in ten years, hitting $16 billion in 2024 FBI Statista Security.org. Older adults (60+) suffered the largest financial losses, nearly $5 billion in 2024 FBI.

⚠️ Risks & Considerations​

  • Underreporting: The FBI estimates only ~15% of cybercrime incidents are reported Security.org, meaning actual losses and infection rates are likely far higher.
  • Regional Vulnerability: U.S. states like Georgia, Florida, and Nevada consistently rank highest in identity theft per capita ConsumerAffairs.
  • Attack Evolution: Criminals increasingly use AI, deepfakes, and sophisticated phishing to bypass defenses deepstrike.io.

In summary: North America has seen explosive growth in cyber threats over the past decade. Malware infections are measured in billions annually, identity theft reports have doubled, and financial losses have skyrocketed past $16 billion. The trajectory shows no signs of slowing, making proactive defense and fraud awareness critical.

View attachment 293760
Compared to the XP days things have gotten better no doubt despite the stats you posted. There has been a noticeable pivot to enterprise in the last few years. The statistics you posted shows a high rise in mobile infections and identity theft, they are not the same as home Windows 11 fully patched infections. Do home users get infected? Yes but there has been progress.


Not a diploma but probably they should know how to read, write, and do arithmetic.

This would be great for all mankind - all people should be forced to undergo extensive society-enforced analysis before they are ever permitted to pro-create and have children.



There's lots and lots of good security instruction on YouTube. Much of it specific, detailed, step-by-step "How To".
I kind of agree with your post, I really like when you don't use A.I bazang and post your true opinions. People need to be made more accountable for their decisions whether in life or to do with cyber security. But you have to give people choice don't we? We all know you shouldn't download and run crackz and warez but people do it anyway until they get stung and get infected? This is where education comes in and you need to educate your children and society otherwise we will keep making the same mistakes.

The problem is we have the time and patience and most likely money, and previous education, to practice safe security. Most people are busy with day to day life and don't have time to study and learn good cyber security practices. It should be like sex education in school, it should be taught and studied in schools from a young age and would prevent many computer problems the general population experiences today and stop computer illiterate people making poor cyber decisions.
 
This is the fundamental flaw of the security software industry and "security is provided by software." The answer - or solutions - depend almost entirely upon what society allows, wants and is willing to fix, and above all else - pay for it. That's not how the world works - and why is that? It is because of people.
but also "curious" that Apple has / had a fairly tight ecosystem, and then laws were passed forcing them to allow this or that into their system (if I said that correctly) :unsure:
 
The problem is we have the time and patience and most likely money, and previous education, to practice safe security. Most people are busy with day to day life and don't have time to study and learn good cyber security practices. It should be like sex education in school, it should be taught and studied in schools from a young age and would prevent many computer problems the general population experiences today and stop computer illiterate people making poor cyber decisions.
You can’t study everything in school. First it’s cyber security, then, it’s popcorn and cotton candy making, then it’s banking, cooking… school can only teach so much.
Life will teach you the rest.
 
You can’t study everything in school. First it’s cyber security, then, it’s popcorn and cotton candy making, then it’s banking, cooking… school can only teach so much.
Life will teach you the rest.
It doesn't have to be university level education, it can be basic 2 hours a week about phishing and safe computer use or what ever else.

Life does teach you true, but education is about preventing mistakes that people have previously made so you don't have to experience them yourself.

People will still make mistakes and learn from history, but just like we teach safe sex and using condoms in high school we can teach safe cyber.
 
but also "curious" that Apple has / had a fairly tight ecosystem, and then laws were passed forcing them to allow this or that into their system (if I said that correctly) :unsure:
This is both correct and unfortunate. The court ruled to make Apple open its closed ecosystem to other software publishers because they were butthurt that they could not make more money on the iOS platform.

All those software publishers did was weaken the security provided by Apple iOS.

"The U.S. courts—specifically Judge Yvonne Gonzalez Rogers in 2021 and later the Ninth Circuit Court of Appeals in 2025—ruled that Apple must allow iOS apps to include links to outside payment systems, breaking its closed ecosystem. Apple was found in willful violation of the injunction when it tried to impose prohibitive fees, and the appeals court upheld contempt findings, forcing Apple to open iOS payments to other publishers"

The "prohibitive fees" were needed as a barrier to entry and to pay for and maintain the Apple iOS app closed system with a high level of scrutiny and strict standards. But the software publisher's felt and had their attorney's argue that Apple's closed system was unfair and prevented them from generating more profit.

Greedy, butthurt software publishers that prioritized their profit over user security. Plain and simple. Easy enough for a 5 year old to understand.
 
You can’t study everything in school. First it’s cyber security, then, it’s popcorn and cotton candy making, then it’s banking, cooking… school can only teach so much.
Life will teach you the rest.
I have colleagues that are teachers and you would think that digital skills and safe, adequate security would be a routine part of the 1st and 2nd world societies, but it is not. Most students are issued Chromebooks and they are right proper taught cybersecurity across the full spectrum of what they should do, can do, and most importantly not do for best security.

Instead, teaches struggle getting the students to keep focused and perform the work load and assignments in an adequate manner.

Many teachers comment that most students have sub-par knowledge, no Google Foo skills, and no in incination NOT to to much of anything to provide even baseline security. Instead they are uneducated and alack skills for their grade level.

The solution to that systemic problem is mandating very specific training requirements.

Maybe. Just maybe will put in the effort to learn by study and doing, and then implements what they learned for maximum security.

However, the latest and greatest of this or that is far more important than security.

This all tieds ino the various roblems have and ultimately just opt to nothing or the cheapest.
Compared to the XP days things have gotten better no doubt despite the stats you posted. There has been a noticeable pivot to enterprise in the last few years. The statistics you posted shows a high rise in mobile infections and identity theft, they are not the same as home Windows 11 fully patched infections. Do home users get infected? Yes but there has been progress.
The amount of breaches, the seriousness of breaches, and the negative consequences of said breeches have increased exponentially since the early XP days.

Given the volume of threats out there, users using weak security solutions create the vast majority of the infection/compromise landscape.
 
But you have to give people choice don't we?
No. No security software publisher is mandated to give people different levels of security based upon their understanding, skills, personalities, propensities, etc.


This is where education comes in and you need to educate your children and society otherwise we will keep making the same mistakes.
Any nation will only be as secure if it mandates users to receive right proper security training.


It should be like sex education in school, it should be taught and studied in schools from a young age and would prevent many computer problems the general population experiences today and stop computer illiterate people making poor cyber decisions.
As you might imagine, this education approach does not exist. Most students through the end of high school are issued Chromebooks.

CyberSec Indoctrination.
 
  • Like
Reactions: Khushal
The moral of the story, even with proper guidance and security one Skip of judgment by the "people" has its effects. It's all it takes. As stated for the most part, people are the problem. Being uninformed is the biggest aspect of that problem, the other is not caring and thinking you can do whatever you want on the web and are untouchable.
People and personnel make "mistakes" that have resulted in far worse that identity and financial loss due to online fraud and other malicious campaigns.

Even SysAdmins with decades of cybersecurity knowledge and skills routinely break the security by granting exceptions.

With U.S. Government and UK GCHQ, the requirements are "PASS/FAIL" and passing is an arduous long term process. Which this is the sort of thing that people cannot handle.
 
Why YT; MT forum is a great source for information, but, unfortunately, you do not like to share.
Why would I share? People here are not open minded and already expressed multiple times that my recommendations do not meet their needs.

I cannot offer anyone here a shortcut - and that is exactly what many MT members here want and expect.
 
  • Like
Reactions: Khushal
Intriguing observation that C2 cum download server is detected by KOTIP as Trojan.Powershell.runner implying that ps1 is the stager of the final payload.
View attachment 293690
new ps1 campaign with updated c2 of Amatera stealer.
such a nagging threat but very low detected threat
1765767051010.png


1765767095986.png
 
People are bad 😗
I never, ever said that, categorically, "People are bad."

If I never explicitly and literally said it, then I never said it.

However you arrived at me stating "People are bad" is the hallways and corridors of your mind adding meaning and intent behind my statements that do not, and never have, existed.


Why to help people?
I help people all the time. In fact every single day.

I am helping you help yourself by declaring "Do your own research" because it will provide you the most benefit - self-learning and paying the technical debt.
 
  • Like
Reactions: Khushal
Adrian i meant no doubt of the efficacy of your testing . my comment was badly put. i have used webroot myself with no issues. i was simply asking the forum how they would react to their doubts about webroot vs your findings . Sincere apologies ... i meant no disrespect . your organisation seems to be one of the few that actually tests webroot and i follow avlabs because of this fact . members have been enlightening about the intricacies of these tests and that has been v helpful too. keep testing . kind regards .
No offense :)

PS. Webroot is also reviewed by PC-Mag.com in its latest review (December 11, 2025: https://www.pcmag.com/picks/the-best-antivirus-protection)

@Parkinsond There is also Bitdefender and is protection against malicious URLs is mediocre, according to PC Mag...
 
I do not like Bitdefender; I would not use, even if I get paid to do so.
Webroot beats Bitdefender when it comes to efficacy of the design. It is primarily cloud-based solution whilst Bitdefender has a solid bulk of definitions to do its job. In terms of protection, it will be different.

Bitdefender having a mediocre web filter, these statements aren’t supported by evidence.