[April 2026 Week 2] Japan Cyber Threat Report : Malware Trends and Security Insights

Japan Cyber Threat Report, Week 2 of April 2026

In April 2026, cyber threats in Japan remain active. What this ranking reveals is a shift from traditional "system-destroying attacks" to attacks targeting authentication credentials and data .

The following malware programs are particularly noteworthy:

Rank	Malware name	number
1	Tycoon 2FA	134,770
2	Emotot	121,775
3	Agent Tesla	54,487
4	EvilProxy	50,555
5	njRAT	49,517
6	RedLine	46,793
7	Lumma	45,185
8	AsyncRAT	44,434
9	Remcos	41,997
10	XWorm	40,365

Illustrated: Trends in the Japan region over the past 14 days, based on publicly available data from the malware analysis platform ANY.RUN.

These rankings are based on actual observational data and show which threats are currently being used most frequently in reality .

This month's threat highlights

① Increase in attacks targeting authentication credentials

What we can see from the increase in "Tycoon 2FA" is,

• Not a system intrusion

• Increase in attacks aiming to bypass authentication

is.

In other words

「ログインできれば勝ち」

The attack has changed to this.

② Spread of information-stealing malware

The following types of malware are on the rise:

• RedLine

• Lumma

• Agent Tesla

these are

• Browser saved information

• password

• Session Information

It specializes in extracting [something].

③ Continued use of remotely controlled malware

• AsyncRAT

• njRAT

• Remcos

These are still widely used.

The reason is simple

• Easy to install

• Can remain dormant for a long period of time

• Difficult to discover

That's why.

Impact on Japanese companies

What we can see from this trend is

「侵入されるか」ではなく「どう使われるか」

This represents a shift in perspective.

In other words

• Silent intrusion

• Used without being noticed

• The damage is spreading.

That's the general flow.

especially

• Business partners

• supply chain

The impact on this cannot be ignored.

5 Security Measures You Can Implement on-Site Right Now

① Strengthening account management

• Thorough implementation of multi-factor authentication

• Minimizing administrator privileges

• Monitoring for suspicious logins

  
  

② Check for leakage of authentication information

• Regularly change your password

• Leak confirmed

• Monitoring of external data leaks

  
  

③ Detection of suspicious behavior

• Detection of communication anomalies

• File access monitoring

• Confirmation of unknown processes

  
  

④ Endpoint protection

• Installing security software

• Blocking suspicious files

• phishing countermeasures

  
  

⑤ Supply chain countermeasures

• Security check of the outsourced company

• Setting minimum standards

• Visualization of external risks

What PIPELINE can do

Malware detection and anomaly detection

RiskSensor visualizes externally visible risks and suspicious communications.

Investigation of unauthorized access

ThreatIDR analyzes traces of the attack to determine the intrusion route and the extent of the impact.

Information leakage prevention measures

DatalaiQ monitors data flow and prevents unauthorized data exfiltration.

summary

Cyberattacks in 2026

From “Destructive Attacks” to “Stealing Attacks”

And it has changed significantly.

Many companies

• The system is protected.

• We are taking measures.

  
  

That's what I think, but in reality

Cases of intrusion that occur invisibly are also increasing.

notice

This 30-minute video clearly explains the process of obtaining a ★3 rating under the SCS (Supply Chain Security Measures) evaluation system. Please register and watch the video.

✦ Finally

Thank you for reading this far.

We at PIPELINE Corporation are a group of experts specializing in cybersecurity and threat intelligence.

We face threats together with our customers on-site every day.

"Even if we have a specialized team within the company, we lack the resources," "We don't know where to start," and "We want to prepare realistically, assuming we will be attacked."

We receive many inquiries like this. Regardless of the size of the company, the current situation is that weak points in defenses are easily targeted.

Furthermore, trying to handle everything internally inevitably makes it easier for things to be overlooked.

That's why we focus on practical methods that are useful in the field, rather than idealistic theories, and propose a small-scale, easy-to-implement approach. Even "a small step within your capabilities" can make a big difference in safety.

If you have any concerns at all, please feel free to contact us. Let's work together to find the quickest way to strengthen your security.