The percentage of malware downloads has fluctuated over the past year, driven by seasonal changes in which adversaries are active and how they choose to deliver their malware payloads to their victims. Today, the percentage of malware downloads is slightly down from where it was a year ago. In Telecom, the percentage of malware downloads fell in line with the global trend, bottoming out in the second half of 2023 and beginning to increase again in early 2024. The abuse of cloud apps allows malware to fly under the radar and evade regular security controls relying on tools, such as domain block lists, or not inspecting cloud traffic.

When it comes to malware sourced from the cloud, Telecom leads the pack by a considerable margin of 7 percentage points. These differences among industries are driven by differences in the adversaries targeting those industries and the behavior of users working in those industries.

Microsoft OneDrive takes the top spot for the most malware downloads in Telecom, although by a smaller margin than other industries. In general, adversaries abuse Microsoft OneDrive because it is the most popular cloud storage app. Meanwhile, people who regularly use Microsoft OneDrive are more likely to click on links to download files shared with them on that platform. Therefore, the number of malware downloads Netskope detects and blocks from Microsoft OneDrive reflects adversary tactics (abusing OneDrive to distribute malware) and victim behavior (their likelihood to click on the links and download the malware). In second place, GitHub is as popular for malware downloads in Telecom as it is in the rest of the world. The other apps in the top 10 are similar to those in other industries with minor differences, including more malware downloads from SourceForce and Google Cloud Storage.