The first half of 2026 was a busy stretch for anyone tracking malware, and most security teams learned about it the way they usually do, through vendor advisories, threat feeds and conversations with peers. Those sources have real benefits, especially for understanding what’s circulating across industries, but by the time a campaign shows up in a feed, someone else has usually already been hit. The earliest signs of what’s targeting your own organization are often much closer to home, in DNS activity that often gets examined only after something breaks.
Every device has to ask where something lives before it can connect to it, whether that’s an employee opening a SaaS app or an infected laptop looking for its command-and-control server. DNS sees that question first and logs it whether the connection works or not, so blocked attempts and lookups for dead domains all leave a trace. Read over time, those queries show what’s happening on your network as it happens, and this year’s data showed how much lead time that can buy.
What the first half of 2026 looked like
Malware went from the fourth-largest DNS-based threat category in the second half of 2025 to the largest in the first half of 2026, with daily activity climbing from about 8 million hits in January to 32.6 million at its April peak. That shift showed up in EfficientIP’s H1 2026 DNS Threat Intelligence Report, which draws on more than 150 billion DNS transactions a day. The surge is the number people remember, but the more useful part is what happened before it.
The earliest sign came from domain generation algorithms,
The earliest sign came from domain generation algorithms, or DGAs, which malware uses to produce large numbers of candidate domain names, only a few of which are registered, so infected machines can keep trying until one leads to their command-and-control server, even if other domains are blocked or seized. A jump in DGA traffic can suggest someone is standing up new infrastructure, and that’s what started showing up in February, when DGA activity rose 24.2% from the month before. Newly observed domains rose 56.8% in March while malicious activity climbed 73.1%, and in April newly observed domains rose another 92.1% and malicious activity 86.8%, just ahead of malware’s peak. Anyone with visibility across global DNS traffic had weeks of warning, and a blocklist couldn’t have given them that, since many of those domains hadn’t been reported anywhere yet.
It’s tempting to assume a threat is over. A domain’s registration expires, or a malware family goes quiet for a few weeks, and it can get marked as handled so attention can move to whatever is active. The trouble is that infected devices don’t know any of that. A machine that was compromised months ago and never cleaned up will keep looking for the infrastructure it was built to find, and those lookups keep showing up in DNS long after a domain has dropped off most people’s radar.
That played out clearly with a DGA family called Unmasked, which kept drawing queries to its domains after their registrations had lapsed and ended June as the most active family in the research. Another family, Phobia, spiked in mid-January, went almost silent within days, and came back in April, growing through May. From the outside, both would have looked finished. From the inside, the query logs would have shown devices still reaching out, which is exactly the kind of lead an investigation should start from.
Phishing infrastructure can come back from the dead
Phishing infrastructure can come back from the dead too. Attackers reuse domains and IP addresses across campaigns, so when a campaign ends or a domain is blocked, the same infrastructure can reappear with a different lure or brand. Phishing targets also come and go.. Social networking dropped from first to seventh among targeted sectors, as Telegram-related activity fell back, while the logistics and courier sector climbed from seventh to third among targeted sectors, largely because of one campaign that started in late June. Delivery lures are likely to pick up as holiday shipping ramps, as we saw in 2025, and DNS is one of the earliest places you’ll see users landing on them.
Start by asking what your security team can actually see in DNS activity. Can it identify which devices are repeatedly trying to reach domains that do not exist? Recognize a surge in newly observed domains? Detect renewed interest in infrastructure associated with an older campaign? These are useful questions for assessing whether DNS data is contributing to threat detection.
Answering them requires visibility across on-premises and cloud environments, supported by analysis that can surface patterns over time. Individual queries rarely tell the full story. Recognizing changes depends on comparing activity over time and linking it to the devices generating it.
From there, build the ability to recognize behavior
From there, build the ability to recognize behavior alongside known-bad matches: sudden spikes in lookups for domains that don’t exist, which can indicate DGA malware cycling through candidates; bursts of newly observed domains; repeat queries for recently expired ones; or a single device querying destinations nobody else in the company touches. These signals give teams a starting point for investigation, but a spike in failed lookups alone does not establish a compromise. The same pattern recurring on a device, alongside other suspicious behavior, is a stronger reason to investigate. Check them against endpoint, identity and threat intelligence data, and use confirmed findings to inform blocking decisions and share relevant indicators with your ISAC.
Threat feeds will always have a place. They tell you what others have discovered. Your own DNS activity can reveal what is taking shape inside your organization before it appears in anyone else’s reporting. Building the visibility to recognize those signals gives your team a chance to act while the attack is still developing.
