DNS Data Showed Malware Surge Weeks Before Attacks Peaked

Malware became the leading DNS-based threat in the first half of 2026, with daily activity rising from 8 million hits in January to 32.6 million in April, according to an EfficientIP report based on more than 150 billion DNS transactions per day.

The more useful signal arrived earlier. Domain-generation algorithm activity increased 24.2 percent in February, one month before malicious activity jumped 73.1 percent in March. Newly observed domains then rose sharply as the malware wave accelerated.

Total DNS threat signals reached 13.85 billion during the half, up 24 percent from the second half of 2025. EfficientIP also found that some malware continued generating queries to expired domains, a reminder that registration status alone does not make a domain harmless.

For security operations teams, DNS telemetry can expose preparation before payloads appear at scale. Monitoring sudden DGA activity, newly observed domains and unusual resolution patterns can help defenders investigate emerging infrastructure before endpoint alerts dominate the queue.