Malware: Where Does It Come From?

The talk asks a simple question: where does malware come from? The speaker draws on roughly 1.2 million malware blocks recorded over about five months, collected by a secure web gateway that covers around 3.1 million users, mostly on managed Windows laptops. Because the data only covers HTTP and HTTPS downloads, phones and other traffic are underrepresented, and the focus is on downloads that were actually blocked rather than everything attackers publish.

The findings challenge the assumption that email is the main route. Most blocked files were ordinary Windows executables and DLLs, and no single malware family dominated. Search engine referrals led people to malicious PDFs built from copied user manual text, titled with very specific product names, and linked to captcha pages and redirect chains. Cloud storage, code hosting and file transfer sites hosted a large share of downloads, and chat platforms were used to lure victims. Content delivery networks and compromised WordPress sites added to the spread, and one infostealer was promoted through a fake cryptocurrency video channel.

The practical takeaway is that category and domain blocking alone will miss much of this traffic. The speaker urges teams to confirm that all web traffic actually passes through their controls, to watch consent grants for third-party apps in cloud suites, and to start from the malware alerts they actually receive and work upstream from there.