New Botnet Puts Home PCs at Risk: AV-Comparatives Publishes Malware Protection Test

The new x47.c botnet is built to hijack Windows PCs. AV-Comparatives tested 20 consumer security products against 10,000 malware samples. Six earned ADVANCED+.

INNSBRUCK, TYROL, AUSTRIA, October 15, 2026 /EINPresswire.com/ -- A new Windows botnet shows why home PCs need real protection. AV-Comparatives tested 20 consumer security products against 10,000 malware samples.

• A current threat: x47.c, a Windows botnet advertised in early October 2026, is built to steal passwords, browser cookies and wallet data and to turn infected private PCs into proxies and DDoS nodes.
• The test: The AV-Comparatives Malware Protection Test September 2026 checked how well 20 consumer security products for Windows stop malicious files before, during and after execution, combined with a false alarm test.
• The result: Six products earned the top ADVANCED+ award: Bitdefender, ESET, G DATA, Kaspersky, Total Defense and VIPRE.

What makes x47.c a threat for private households?
In early October 2026, researchers at Qrator Research Labs reported on x47.c, a new Windows botnet sold by a threat actor calling itself WraithTools. It bundles credential theft, DDoS attacks, proxying and a feature that drains paid AI accounts.
On an infected PC, x47.c can harvest saved passwords and cookies from web browsers and collect Discord tokens, crypto wallet data and AI service tokens. An advertised "AI Stealth" module even uses xAI's Grok to choose how the malware stays active after a reboot.
Qrator's findings are based on the seller's advertising and documentation, so they show what x47.c is designed to do, not how widely it has spread. The researchers explicitly name antivirus and endpoint security software as one line of defence and warn that removing the malware does not undo credentials that have already been stolen.

Why should home users and small offices care?
Botnets like x47.c depend on ordinary computers. A single infected family PC or home office laptop can hand over online banking and shopping logins, expose a crypto wallet and lend its internet connection to criminals as a proxy or as part of a DDoS attack. For freelancers and small businesses running a few devices on one router, this means business accounts, customer data and the shared network are all at risk, usually without a dedicated IT department to notice.
Home workers are a proven target: in August 2026, the US Department of Justice announced the extradition of a suspect accused of spreading remote access malware to around 80,000 freelancers via malicious Excel attachments.

How did AV-Comparatives test protection against such threats?
Against this backdrop, AV-Comparatives put 20 consumer security products for Microsoft Windows through its Malware Protection Test in September 2026, using a set of 10,000 malware samples. The test covers infection routes such as network drives, USB devices and malware that is already on the disk, complementing the web based Real-World Protection Test.
Every sample was scanned offline and online, then executed if undetected, so that behavioural protection could come into play. A test case counted as a miss if the product did not prevent or reverse all changes made by the malware. A separate false alarm test checked how reliably each product tells clean files from malicious ones, because false alarms can cause as much trouble as a real infection.

Which products achieved the best results?
Fifteen of the 20 products reached the highest protection cluster. The final award level also reflects the number of false alarms, which is why several products with very high protection rates did not reach the top award.

ADVANCED+
Bitdefender, ESET, G DATA, Kaspersky, Total Defense, VIPRE

ADVANCED
Avast, AVG, F-Secure, Fortect, Norton, TotalAV

STANDARD
McAfee, Microsoft

TESTED
K7, Malwarebytes, Panda, Quick Heal, Sophos, Trend Micro

The test also shows how strongly many products rely on the cloud. Offline detection rates ranged from 40.2 to 97.3 percent. For users whose connection drops, or whose product cannot reach its cloud service, this can make a noticeable difference.

What does AV-Comparatives say?
"Cybercriminals do not distinguish between a corporate network and a family PC. Every unprotected home computer is a potential source of stolen logins and a free resource for their botnets. Our Malware Protection Test shows that good protection is available for private users and small offices, and it shows just as clearly that the differences between products are real." Andreas Clementi, Founder and CEO, AV-Comparatives

FAQ
Is a security suite still necessary on a private PC? Yes. Campaigns such as x47.c target ordinary Windows computers, and stolen logins or a hijacked internet connection affect private users just as much as companies. AV-Comparatives recommends using a tested security solution on every device.
What is the difference between detection and protection? Detection means a file is recognised as malicious before it runs. Protection also counts cases where a product stops or reverses the malware's actions after execution, for example through behavioural analysis.
Should buyers choose a product on the basis of this test alone? No. AV-Comparatives advises looking at several recent test reports as well as price, ease of use, compatibility and support, and trying a free trial version before buying.

Conclusion
x47.c is a reminder that modern malware is built for scale, and that private PCs and small office networks are part of that scale. Independent testing helps home users and small businesses choose a product that reliably stops malicious files without flooding them with false alarms.
Read the full report with all protection, detection and false alarm results, free of charge and without registration: www.av-comparatives.org/tests/malware-protection-test-september-2026

About AV-Comparatives
AV-Comparatives is the world's leading independent cybersecurity testing organization, headquartered in Innsbruck, Austria. We rigorously test PC, Mac, and mobile security solutions to verify that they deliver on their promises, using one of the largest threat collections available worldwide to replicate real-world conditions with unmatched accuracy. Our results are freely accessible to individuals, media organizations, and the scientific community. The AV-Comparatives certification mark is a globally recognized seal of excellence for software performance.

Thomas Uhlemann
AV-Comparatives GmbH
press@av-comparatives.org
Visit us on social media:
LinkedIn
Instagram
Facebook
YouTube
Other