<p>Malware data in real-world cybersecurity applications are typically distributed across multiple organizations, and privacy, security, and compliance constraints prevent these data from being shared with a central server. The malware distributions observed by different organizations are also highly non-independent and identically distributed (non-IID), which limits both centralized training and conventional federated learning (FL). Most existing federated malware classifiers further rely on a single modality, leaving multimodal feature complementarity under non-IID client distributions insufficiently evaluated. To address these issues, a federated multimodal malware classification framework is proposed for non-IID settings. Each client encodes a malware sample into two complementary static views, a three-channel image and a fixed-length token sequence. A bidirectional cross-attention module with adaptive residual fusion lets the two modalities calibrate each other while introducing a bounded residual visual path to reduce sensitivity to unstable attention-enhanced features. To mitigate client heterogeneity, FedBN is adapted so that batch-normalization statistics stay local and only the remaining parameters are aggregated. Experiments on the Microsoft BIG 2015 dataset show that the proposed method outperforms unimodal baselines, remains competitive with strong multimodal fusion methods under both IID and non-IID partitions, and converges more stably under highly skewed label distributions. A security-oriented evaluation further shows that the framework retains useful robustness under targeted label-flipping attacks, and that coordinate-wise median aggregation can further improve resilience.</p>