Weekly report by the TG Soft CRAM, concerning Italian malspam campaigns.

Below are the details of the campaigns released during from 17 November to 23 November 2025.

During the monitored week, both global campaigns and Italian-language campaigns decreased compared to the previous week.The week was characterized by Password Stealer of the Familiies:  AgentTesla, DCRAT and Remcos.

The blue bar shows the total number of campaigns monitored in Italy in each week, while the red bar concerns campaigns in Italian (and targeting Italy).

We monitored 28 campaigns during the week, 6 of which used Italian as their language.

In order to understand how the various weeks are divided, below is a small table showing the breakdown of the considered period:

During the week, the peak in global campaigns was recorded on Thursday, 20 November, with 10 different campaigns per day. The peak of campaigns in Italian was recorded on Friday, 21 November, with 3 campaigns per day, as shown in the graph below:

In the following chart we see the malware families spread globally for each day of the week:

Instead in this graph we see the distribution based on malware family. In the past week 11 different families were detected:

The samples that have ranked in first place this week are Script files with 57.15%.
In second place are Office documents (Word, Excel, PowerPoint) with 21.43%.
As for third place, we find MSIL executable files with 10.71%In the chart below we can see the various types of language used to develop malware:

In the chart below we can see the various types of language used to develop malware:

Check out the October/November campaigns

We invite you to check out the October/November 2025 reports, to stay up-to-date on the malspam campaigns circulating in Italy: