What is malware?

Malware is malicious code or software designed to com­pro­mise devices, ap­pli­ca­tions, servers or networks. It can steal data, interfere with systems or disrupt access to them. The best-known types of malware include viruses, Trojans and worms.

Key Takeaways ⓘ

• Malware is a general term for malicious software designed to com­pro­mise devices, steal data or disrupt systems.
• It can get onto a computer through email at­tach­ments or links, infected downloads, com­pro­mised websites or outdated software.
• Common types include viruses, worms, Trojans, ran­somware, spyware, in­fos­teal­ers and scareware.
• Well-known examples include ILOVEYOU, Emotet, MyDoom, WannaCry, Pegasus and the BKA Trojan.
• Antivirus software and firewalls reduce the risk, but they don’t replace regular updates, backups, access controls or security training.

What is malware?

Malware is a general term for malicious software that can get onto a device and perform unwanted actions. The name comes from a com­bi­na­tion of “MALicious” and “softWARE.” Unlike ordinary software bugs, malware is designed to cause harm. For example, a program might crash because it isn’t com­pat­i­ble with an operating system. Malware, on the other hand, is de­lib­er­ate­ly created to in­fil­trate devices or networks and cause damage. Sometimes it goes un­de­tect­ed for a long time, causing serious harm before anyone notices. Antivirus software and firewalls can sig­nif­i­cant­ly reduce the risk, but they don’t replace regular updates, backups, access controls or security training.

How does malware get onto a computer?

Malware can get onto a computer in several ways, even when you have security measures in place. One of the most common ways is through email at­tach­ments or links that run malicious code when opened. Down­load­ing infected software from un­trust­wor­thy sources is another major risk. Malware can also spread through com­pro­mised websites, security vul­ner­a­bil­i­ties in outdated software or external storage devices such as USB drives. Attackers often use social en­gi­neer­ing to trick people into running malware them­selves.

These days, malware is often just one part of a larger attack. Criminals might steal login cre­den­tials, sell access to com­pro­mised systems, extract data and then deploy ran­somware or use the stolen in­for­ma­tion for extortion.

What are the different types of malware?

There are several types of malware, and they don’t all work the same way. Un­der­stand­ing how a malicious program works and what it’s designed to do is important when deciding how to deal with it. Viruses, Trojans and worms have been around for decades, but malware has evolved since then. Ran­somware and spyware are now major threats, and many malicious programs combine different tech­niques. Let’s look at the main types of malware and how they work.

Computer viruses

People often use the word “virus” to describe any kind of malware, but viruses are actually just one type. What sets them apart is how they spread: they make copies of them­selves and attach to other files or programs to infect other parts of a computer or network. Viruses can do different things. Some slow down, disrupt or even destroy systems, while others secretly steal in­for­ma­tion. Computer viruses are less common today than other types of malware such as ran­somware and Trojans, but they’re still one of the basic types of malware.

Computer worms

Computer worms work in a similar way to viruses, but there’s one key dif­fer­ence: while viruses attach them­selves to other files, worms don’t need a host file.

Worms can make copies of them­selves and spread au­to­mat­i­cal­ly, quickly infecting other systems through networks or security vul­ner­a­bil­i­ties. They can cause serious damage by copying data, slowing down systems or down­load­ing ad­di­tion­al malware.

Worms spread mainly through networks, but they can also spread through email, messaging apps or external storage devices.

Trojan horse

A Trojan horse, or simply a Trojan, is a type of malware that disguises itself as a harmless or even useful program. Its name comes from the wooden horse in Greek mythology, which Greek soldiers used to sneak into the city of Troy.

Once installed, a Trojan can secretly monitor the infected system, copy data, change system settings or open the door for other malware. Some Trojans even allow attackers to control the computer remotely.

Unlike viruses and worms, Trojans generally don’t spread on their own. Instead, attackers usually trick people into in­stalling them.

Ran­somware

Ran­somware typically infects a system through security vul­ner­a­bil­i­ties or by tricking people into in­stalling it. Once inside, it can encrypt files or block access to the device.

The attackers then demand a ransom to restore full access to the system. That’s where the name “ran­somware” comes from. Many modern variants also steal data and threaten to publish it if the ransom isn’t paid.

Paying the ransom is generally not rec­om­mend­ed because there’s no guarantee the attackers will actually restore access to the data. Instead, you can try to remove ran­somware using spe­cial­ized security software. Once the system is clean, you can restore affected data from a clean backup.

However, removing ran­somware doesn’t always reverse the damage. Even after the malware is gone, the affected files will usually remain encrypted.

Spyware

Spyware is a type of malware that secretly spies on people and collects in­for­ma­tion from their computers or other devices. The in­for­ma­tion can then be used by the attackers them­selves or shared with third parties.

Spyware can also affect how a computer works. It may slow down the system, change settings or download ad­di­tion­al malware.

In­fos­teal­er

In­fos­teal­ers are a type of malware designed to steal login cre­den­tials and other sensitive in­for­ma­tion from infected devices. They typically target:

• saved passwords
• browser data
• cookies
• session tokens
• payment in­for­ma­tion
• data from cryp­tocur­ren­cy wallets

Unlike spyware, which often monitors people’s activity over time, in­fos­teal­ers are designed to steal specific data quickly. Attackers often sell the stolen in­for­ma­tion or use it to carry out other attacks. These later attacks may involve taking over accounts, stealing iden­ti­ties or spreading ran­somware.

Scareware

As the name suggests, scareware uses fake security warnings to frighten people into down­load­ing software that sup­pos­ed­ly protects their computer from a threat. If someone downloads the software, it often installs ad­di­tion­al malware instead of fixing the supposed problem.

Scareware can also trick people into revealing sensitive in­for­ma­tion or in­stalling remote access software. This often happens as part of a tech support scam.

My­De­fend­er

Easy cyber security

• Regular virus and malware scans
• Automatic backups and simple file recovery

See plans

What are some well-known examples of malware?

There are many different types of malware, and you’ve probably heard of some of the programs behind major cy­ber­at­tacks. Here are a few examples.

ILOVEYOU

ILOVEYOU was one of the early malware attacks that paved the way for many others. In 2000, it spread through malicious email at­tach­ments and infected millions of computers. Once activated, the malware made copies of itself, sent itself to more contacts and overwrote numerous files on infected computers. It also stole login cre­den­tials and left some systems unusable. The attack caused major email outages worldwide and billions of dollars in economic damage. ILOVEYOU made more people aware of the dangers posed by malware.

Emotet

Emotet is a Trojan that was first dis­cov­ered in 2014. It copies email addresses, sender names and email headers to create messages that look genuine. It often uses existing email con­ver­sa­tions to make these messages even more con­vinc­ing.

When someone opens an infected at­tach­ment, ad­di­tion­al malware is installed. This malware can shut down systems or steal sensitive in­for­ma­tion such as banking details. Emotet often acts as a “loader,” meaning it downloads other malware, including ran­somware. This allows attackers to com­pro­mise entire networks. After several attempts to either shut down or disrupt Emotet, it has appeared less fre­quent­ly in large-scale attacks since 2023.

MyDoom

MyDoom is a computer worm that spread rapidly in 2004, making it one of the fastest-spreading worms ever. It’s estimated to have caused several billion dollars in damage. Nobody knows exactly where it came from, although its code contains the line “andy; i’m just doing my job, nothing personal, sorry”. The worm made copies of itself and spread mainly through email, but it also used peer-to-peer networks. It launched targeted DDoS attacks against the SCO Group and later Microsoft. At its peak, MyDoom is estimated to have reduced internet per­for­mance worldwide by around 10%.

WannaCry

WannaCry made headlines around the world in May 2017. The ran­somware encrypted files on more than 200,000 computers in over 150 countries. Victims were asked to pay US$300 in Bitcoin, with the ransom in­creas­ing to US$600 after three days. WannaCry used the Eter­nal­Blue exploit to take advantage of a Windows security vul­ner­a­bil­i­ty and spread au­to­mat­i­cal­ly through networks. The UK’s National Health Service (NHS) was hit par­tic­u­lar­ly hard. Important surgeries had to be postponed because staff couldn’t access patient records. Major in­ter­na­tion­al companies, including Nissan, FedEx and Deutsche Bahn, were also affected. The total damage is estimated at around US$4 billion.

Pegasus

Pegasus is spyware developed by the Israeli company NSO Group. It’s mainly used to spy on iOS and Android smart­phones and can infect a device without the person using it having to do anything. These are known as zero-click attacks. Once installed, Pegasus can access a wide range of in­for­ma­tion and features on the phone, including messages, the camera, mi­cro­phone and location data. NSO Group’s customers are mainly gov­ern­ments. According to official state­ments, they use Pegasus ex­clu­sive­ly for criminal in­ves­ti­ga­tions and coun­tert­er­ror­ism. However, Pegasus has faced wide­spread criticism because it has also been used to spy on jour­nal­ists, activists and political opponents, as confirmed in several cases.

BKA Trojan

The BKA Trojan is a com­bi­na­tion of scareware and ran­somware. Once it infected a computer, it locked the screen and displayed a full-page warning instead of the usual startup screen. The warning claimed that Germany’s Federal Criminal Police Office (BKA) had found illegal content on the device. People were then told they had to pay to regain access, often through payment services such as Paysafe­card. In many cases, the malware didn’t actually encrypt any files. It simply blocked access to the computer. The BKA Trojan first appeared around 2011 and caused serious damage despite using rel­a­tive­ly simple tech­nol­o­gy.