In the first half of 2026, malicious software was used in 65% of successful attacks on Russian companies. Such programs help attackers penetrate corporate networks, maintain access to them, and reach critical systems. This is reported by "Kommersant" with reference to the Positive Technologies report, which specifically highlights the threat of common work documents.

Microsoft Office files accounted for 26% of malware delivery cases. Word and Excel documents can serve not only as a container for dangerous code, but also as a tool for its launch and entrenchment in the system. Attackers also use standard programs, which makes their actions harder to distinguish from normal employee work.

Among the malicious programs detected in network traffic since autumn 2025, about half were Trojans – software that performs actions on a device without user permission. Approximately another quarter accounts for information-gathering programs. In this group, 85% are credential theft tools, while the rest monitor human actions.

Email remains one of the main channels for threat propagation, according to "Informzashchita". It is supplemented by messengers and downloading programs from unverified sources. Attackers also penetrate corporate networks through vulnerable external services and contractors.

Programs for stealing logins and passwords are particularly dangerous: they can operate unnoticed while an employee continues to use the computer. The obtained access credentials are then sold or transferred to other attack participants. They use them to penetrate infrastructure, steal data, and extort.