Surfshark Antivirus: 92% of malware detections in 2026 were on Windows devices

Cybercriminals often rely on malicious software to break into devices, steal sensitive information, and make money from victims. From January through July 2026, Surfshark Antivirus logged 391K detections, and the overwhelming majority were tied to Windows. While Windows users made up 66% of the active user base, they accounted for 92% of all detections, showing that Windows users encountered threats at a far higher rate than macOS users.

The figures also show clear differences in the kinds of threats seen on each platform. Trojans and riskware were among the most common on both Windows and macOS, but trojans were far more dominant on Windows. On the other hand, phishing made up a noticeably larger share of detections on macOS. Overall, the results indicate that Windows remains the primary focus for malware activity, even though users on both systems are exposed to a variety of threats.

Key insights

• In 2026, Surfshark Antivirus recorded 391K malware detections. Windows users made up 66% of its active user base but accounted for 92% of all detections. By comparison, macOS users represented 34% of active users and just 8% of detections. This means that, on average, Surfshark Antivirus recorded nearly six times as many detections per user on Windows compared to macOS.
• Trojans and riskware were the two most common malware types on both Windows and macOS. However, trojans were considerably more prevalent on Windows, accounting for 46% of detections compared with 25% on macOS. Riskware represented 19% of Windows detections and 17% on macOS. Trojans¹ disguise themselves as legitimate programs but can perform harmful actions or download additional malware, while riskware¹ is legitimate software that can be misused to compromise system security.
• Viruses and heuristic detections also accounted for a notable share of malware detections on both Windows and macOS. Interestingly, viruses made up 9% of detections on both platforms, ranking third on Windows and fifth on macOS. Meanwhile, heuristic detections ranked fourth on both systems, accounting for 13% of detections on macOS and 8% on Windows. Viruses¹ are pieces of code that insert themselves into applications and execute when the apps are run, while heuristic detections¹ flag files that behave like viruses, even if they aren't yet in databases of known threats.
• Phishing was another common threat on both operating systems, although it accounted for a much larger share of detections on macOS. It ranked third on macOS, representing 15% of detections, compared with sixth place and just 3% on Windows. Phishing¹ uses deceptive emails, calls, instant messages, files, and other communication methods to trick people into revealing personal information.
• Rounding out the notable threats was adware, which ranked fifth on Windows with 4% of detections and eighth on macOS with 3%. Adware¹ can display advertisements by modifying the websites people visit or opening additional pages in their browsers. It can go unnoticed because it is often bundled with other downloads. For example, free programs may include adware as a default installation option, causing users to install it unintentionally.

Methodology and sources

Data was collected anonymously from Surfshark Antivirus, covering the period from January 1 to July 31, 2026. We analyzed common threats targeting both Microsoft Windows and Apple macOS, identifying the most prevalent malware types on each platform. Furthermore, detection rates were compared with each platform's active user base to accurately determine the average number of threats encountered per user.

You can also check our previous 2025 Surfshark Antivirus overview here².

References: