AV-Comparatives test spotlights home-PC risk from new x47.c botnet

AV-Comparatives published its September 2026 Malware Protection Test after a new Windows botnet, x47.c, surfaced as a threat to home users and small offices. Six of 20 consumer security products earned the top ADVANCED+ award, with protection and false positives both shaping the results.

Why it matters: - x47.c targets ordinary Windows PCs, not just corporate networks. - The botnet is designed to steal passwords, browser cookies, crypto wallet data and AI service tokens. - Infected home PCs can also be turned into proxies or DDoS nodes, putting family users, freelancers and small offices at risk. - AV-Comparatives says independent testing helps buyers choose security software that blocks malware without flooding users with false alarms.

What happened: - AV-Comparatives published its Malware Protection Test September 2026 and evaluated 20 consumer security products for Windows. - The lab used 10,000 malware samples and measured whether products stopped malicious files before, during and after execution. - Six products earned ADVANCED+: Bitdefender, ESET, G DATA, Kaspersky, Total Defense and VIPRE. - The test also included a false alarm check. - A full report is available here.

The details: - Researchers at Qrator Research Labs reported on x47.c in early October 2026. - The botnet was advertised by a threat actor calling itself WraithTools. - Qrator said x47.c bundles credential theft, DDoS attacks, proxying and a feature that drains paid AI accounts. - The malware can harvest saved browser passwords and cookies, collect Discord tokens and pull crypto wallet data. - An advertised “AI Stealth” module uses xAI’s Grok to decide how the malware stays active after a reboot. - Qrator said its findings are based on seller advertising and documentation, so they show what x47.c is designed to do, not how widely it has spread. - Qrator also warned that removing the malware does not restore credentials that were already stolen. - Fifteen of the 20 products reached the highest protection cluster, but false alarms affected the final award level. - Products in the ADVANCED tier were Avast, AVG, F-Secure, Fortect, Norton and TotalAV. - Products rated STANDARD were McAfee and Microsoft. - Products listed as TESTED only were K7, Malwarebytes, Panda, Quick Heal, Sophos and Trend Micro. - Offline detection rates ranged from 40.2% to 97.3%, showing that cloud dependence can matter when a device loses internet access. - The test examined infection routes including network drives, USB devices and malware already on disk. - Every sample was scanned offline and online, then executed if undetected so behavioral protection could be measured. - A miss counted when a product did not prevent or reverse all changes made by the malware. - The separate false alarm test checked how well each product distinguished clean files from malicious ones.

Between the lines: - The x47.c case shows how commodity malware now targets personal devices as infrastructure for crime. - Protection rates alone do not tell the full story because a product can miss too much, or create too many false positives, and still fail real users. - The spread between offline detection scores suggests that users cannot assume cloud-connected protection will work the same way on every device. - AV-Comparatives’ setup favors practical defense, not just static file detection.

What's next: - AV-Comparatives recommends that buyers compare several recent test reports before choosing a product. - The organization also advises weighing price, usability, compatibility and support, and trying a free trial before purchase. - Home users and small offices are expected to keep facing botnets that target credentials, crypto assets and remote-work logins.

The bottom line: - x47.c is another reminder that home PCs are valuable targets. - AV-Comparatives says tested security software remains a key defense, especially for users without dedicated IT support.