Malware software now encrypts the data of Internet of Things (IoT) enabled fog nodes, preventing the victim from accessing it unless they pay a ransom to the attacker. The ransom injunction is constantly accompanied by a deadline. These days, ransomware attacks are too common on IoT healthcare devices. On the other hand, IoT-based heartbeat digital healthcare applications have been steadily increasing in popularity. These applications make a lot of data, which they send to the fog cloud to be processed further. In healthcare networks, it is critical to examine healthcare data for malicious intent. The malware is a peace code with polymorphic and metamorphic attack forms. Existing malware analysis techniques did not find malware in the content-aware heartbeat data. The Adaptive Malware Analysis Dynamic Machine Learning (AMDML) algorithm for content-aware heartbeat data in fog cloud computing is described in this article. Based on heartbeat data from health records, an adaptive method can train both pre- and post-train malware models. AMDML is based on a rule called ‘federated learning,’ which says that malware analysis models are made at both the local fog node and the remote cloud to meet the performance workload safely. The simulation results show that AMDML outperforms machine learning malware analysis models in terms of accuracy by 60%, delay by 50%, and detection of original heartbeat data by 66% compared to existing malware analysis schemes. © 2023 The Authors. CAAI Transactions on Intelligence Technology published by John Wiley & Sons Ltd on behalf of The Institution of Engineering and Technology and Chongqing University of Technology.