What Is a Crypter? The Hidden Reason Your Antivirus Might Miss an Attack

A crypter is a tool or service that scrambles malware so your antivirus can’t recognise it. Think of it like putting a stolen car through a chop shop — same engine underneath, but the bodywork looks completely different to anyone checking plates.

The Australian Signals Directorate has just published a joint advisory with the AFP, NZ Police, Google and the UK’s National Crime Agency warning that crypter-as-a-service operations are now widespread on dark web marketplaces. For as little as US$25, an attacker can run a piece of malware through automated crypter software and get back a version that passes every major antivirus scan.

Why this matters right now

Most small businesses in Australia still rely primarily on signature-based antivirus — the type that checks files against a list of known threats. That’s exactly what crypters are built to beat. A crypted file has no known signature. It slips past the scan, runs on the machine, and starts doing damage before anyone notices.

We see this pattern regularly in our client environments: a business has antivirus installed and assumes it’s protected, but the malware that actually gets through is the stuff the signature database has never seen. Crypter services are a big reason why.

What to do about it

The ASD advisory recommends three practical steps that any business can act on:

Deploy endpoint detection and response (EDR) instead of relying on antivirus alone. EDR watches how programs behave, not just what they look like — so even a freshly crypted file gets flagged when it tries to steal credentials or inject code into a system process.

Enable application control so only approved software can run on your machines. If a crypted payload can’t execute in the first place, it doesn’t matter how well it’s hidden.

Keep everything patched. Crypters help malware get onto a system, but attackers still need a way in. Unpatched software is the most common door they use.

If your business is still running basic antivirus without behavioural detection, talk to us about an EDR upgrade. It’s one of the single most effective changes a small business can make right now.