Skip to content
Knowledge Hub/Article
Article

What Is Malware? Types, Trojans and Protection

Learn how viruses, worms, trojans, spyware and infostealers differ, how malware gets in, the signs of infection and the controls that stop it.

Oğuzhan Gerçek··9 min read
What Is Malware? Types, Trojans and Protection

Short answer: Malware (malicious software) is software that is covertly placed on a system to damage data, applications or the operating system. Viruses, worms, trojans, ransomware, spyware, rootkits and information stealers (infostealers) are all types under this umbrella. It usually gets in through phishing emails, fake or pirated software, an unpatched vulnerability, a USB drive or the supply chain. Protection comes in layers: EDR, regular patching, least privilege, application allowlisting, email filtering and backups that attackers cannot reach.

What is malware?

NIST's malware guide, SP 800-83 Rev. 1, defines malware as a program that is covertly inserted into another program with the intent to destroy data, run destructive or intrusive programs, or otherwise compromise the confidentiality, integrity or availability of the victim's data, applications or operating system.

Malware is short for "malicious software" and works as an umbrella term; a virus is just one type. Verizon's 2026 Data Breach Investigations Report (DBIR), which covers incidents between November 1, 2024, and October 31, 2025, found a hacking action in 64% of breaches and a corresponding malware action in 63%. As the report puts it, malware usually needs a little help to get its foot in the door. We cover where the threat fits within cybersecurity in a separate article.

Types of malware

  • Virus: According to NIST, it replicates by attaching copies of itself to other programs or files; it cannot run by itself and becomes active only when its host program runs.
  • Worm: A self-contained program that copies itself across a network onto other systems without user intervention. Unlike a virus, it does not need a host program.
  • Ransomware: Encrypts files and demands payment; it was present in 48% of breaches in the 2026 DBIR. We go into detail in our ransomware article, and there is a short definition in our glossary.
  • Spyware: Is secretly installed on a system and gathers information about people or organizations without their knowledge.
  • Adware: Displays advertising. NIST counts some forms of adware as malicious code, whereas Microsoft classifies this software as potentially unwanted applications (PUA), which it does not consider malware.
  • Rootkit: According to NIST, a set of tools that conceals an attacker's activities on a device and lets them keep root-level access through covert means. The many changes it makes to hide itself make it hard to find.
  • Keylogger: Monitors and records keyboard use. According to Microsoft, password stealers often work together with a keylogger.
  • Bot (botnet agent): According to SP 800-83, it is installed on a device to make it attack other systems. We cover botnets, the networks these devices form, in our DDoS article.

What is a trojan (Trojan horse)?

According to NIST's glossary, a trojan is a program that appears to have a useful function but also has a hidden and potentially malicious function that evades security mechanisms. As NIST's original 2005 guide notes, it is named after the wooden horse of Greek mythology.

What sets a trojan apart from viruses and worms is that it does not replicate, which is why the common phrase "trojan virus" is technically inaccurate. According to Microsoft, a trojan cannot spread on its own: either the user downloads it, or another piece of malware downloads and installs it. To trick users, trojans often use the same file names as real, legitimate apps.

Once installed, a trojan can download other malware, record keystrokes, send passwords to the attacker or give them control of the device. Microsoft's classification also lists these functions as separate types: the backdoor, which gives remote access; the downloader, which fetches other malware from the internet; and the dropper, which installs the malware it carries without connecting to the internet.

Infostealers, fileless malware and coin miners

Infostealers: According to Microsoft's analysis, Lumma Stealer is a malware-as-a-service (MaaS) offering that extracts saved passwords, session cookies and autofill data from browsers. Between March 16 and May 16, 2025, Microsoft identified more than 394,000 Windows computers infected with Lumma worldwide. Microsoft recommends phishing-resistant authentication; we compare the methods in our MFA article.

Fileless malware: According to Microsoft, fully fileless malware never writes a file to disk, and scripts run inside a legitimate interpreter such as PowerShell. When there is no file to scan, detection has to be behavior-based.

Coin miners: Mining takes significant computing power, and a miner running covertly inside an organization eats up that power and degrades performance.

How does malware spread?

  • Phishing: Email carrying a malicious attachment or link. We explain how to spot it in our phishing article.
  • Malicious downloads: Microsoft's Lumma analysis highlights fake search ads, pirated software and fake CAPTCHA pages (ClickFix) that talk users into running a command themselves. Simply visiting a website can be enough (ATT&CK T1189).
  • Unpatched vulnerabilities: An exploit uses a vulnerability in software to get onto a device. We cover how these gaps are closed in our patch management article.
  • Removable media: A USB drive can carry malware even onto air-gapped systems (T1091).
  • Supply chain: According to Microsoft, attackers hide malicious code in the build or update process of legitimate software. Because the update arrives signed by the vendor, it looks trustworthy, and even the vendor may not notice (T1195).

How can you tell if a device is infected?

The list published by the US Federal Trade Commission (FTC) includes signs users can spot themselves: the computer slows down, freezes or crashes; the browser's home page changes; new toolbars or add-ons appear; unexpected ads pop up; tools such as Task Manager are disabled; emails you didn't write are sent from your account.

In an organization, relying on users is not enough. According to SP 800-83, no indicator is completely reliable, and the obvious data sources are antivirus software, intrusion detection systems (IDS) and SIEM. The guide calls for infected hosts to be identified through automated means. We explain who acts on those alerts in our SIEM and SOC article.

How to protect against malware

  • EDR: We explain the difference between signature-based antivirus and behavior-monitoring EDR in our endpoint security article; antivirus and managed antivirus are defined in our glossary.
  • Patching: Closes the vulnerabilities that exploits use. We handle prioritization on our Patch & Vulnerability Management page.
  • Least privilege: According to SP 800-83, malware often requires administrator-level privileges to exploit a vulnerability. The access model is the subject of our IAM article.
  • Application allowlisting: NIST SP 800-167 defines an application whitelist as a list of applications and application components authorized for use in an organization; anything not on the list does not run. CIS Controls v8.1 asks for this separately for software, libraries and scripts (2.5, 2.6, 2.7). According to Microsoft, security organizations frequently cite application control as one of the most effective ways to address executable file-based malware.
  • Email filtering: SP 800-83 recommends scanning attachments before they are opened and blocking file types such as .exe in email. We cover domain authentication in our business email article.
  • Removable media: CIS calls for autorun to be disabled and removable media to be scanned automatically (10.3, 10.4).
  • Backups: A clean backup keeps the option of rebuilding a device from scratch open; you will find the backup types in our backup article.

What to do if malware gets in

NIST's SP 800-61 Rev. 3, published in April 2025, ties incident response to the CSF 2.0 Functions: Govern, Identify and Protect are preparation, while the response itself is Detect, Respond and Recover. Three steps stand out in a malware incident:

  1. Containment: The goal is to prevent the incident from spreading. SP 800-83 asks organizations to be ready to block services used by malware and, if needed, disconnect devices from the network; containment should not be left to users.
  2. Eradication: The malware is removed. According to SP 800-61 Rev. 3, persistence mechanisms and entry points may also need to be eliminated.
  3. Recovery: SP 800-83 asks organizations to plan recovery in advance with worst-case scenarios in mind, including rebuilding a device from scratch or from known good backups. The FTC also recommends changing passwords.

We cover the first hours of a ransomware incident in our ransomware article. We describe 24/7 detection and response on our security operations page.

Frequently asked questions

What does malware mean? Malware is short for "malicious software." It is the umbrella name for programs written to damage a system or steal data.

What is the difference between a virus and malware? Malware is the general name for all malicious software, and a virus is one type of it. What sets a virus apart is that it replicates by attaching itself to other programs or files.

What is a trojan virus? The term usually refers to a trojan: a program that looks useful but carries a hidden malicious function. Because it does not replicate on its own, it is technically not a virus.

What are the types of malware? The main types are viruses, worms, trojans, ransomware, spyware, adware, rootkits, keyloggers, bots, fileless malware, infostealers and coin miners.

How can you tell if a computer has malware? Slowdowns, a changed browser home page, unexpected ads and disabled system tools can all be signs. In organizations, detection should rely on automated tools.

Sources