Malware, short for malicious software, is any program, script or code fragment that is intentionally designed to compromise the confidentiality, integrity or availability of a system, for example by stealing data, encrypting files, spying on users or taking remote control. In cybersecurity, malware is the umbrella term for viruses, worms, trojans, ransomware, spyware, rootkits and similar threats, and it is the technical payload of most attacks after initial access has been gained.
What makes code malware is intent and lack of authorization, not the technique. Remote administration tools, scripting engines and encryption are legitimate in the hands of an administrator, and they become malicious when an attacker uses them without the owner’s consent.
How malware is classified
Malware is classified along two independent axes: how it spreads and what it does once it runs. A single sample usually belongs to several categories at once, so a worm can carry a ransomware payload, and a trojan can install a rootkit. Labels used by security vendors therefore describe dominant behavior rather than strict biological-style species.
The following table compares the three classic propagation mechanisms, which still determine how quickly an infection can grow inside a network.
| Mechanism | Needs a host file | Self-replicates | Needs user action |
|---|---|---|---|
| Virus | Yes, it inserts itself into files or boot sectors | Yes | Usually, to run the infected file |
| Worm | No, it is a standalone program | Yes, across networks | No, it exploits services automatically |
| Trojan | No, it poses as legitimate software | No | Yes, the victim installs or opens it |
Worms are the most dangerous in terms of speed, because they spread without human help. In 2017, WannaCry used the SMBv1 exploit known as EternalBlue to infect hundreds of thousands of Windows computers within days, mostly systems that lacked a security update released two months earlier.
Main malware types by payload
The payload defines the business impact of an infection. Modern attacks often chain several payloads: a small loader downloads an infostealer, and the stolen credentials later enable a ransomware deployment.
| Type | Primary goal | Typical behavior |
|---|---|---|
| Ransomware | Extortion | Encrypts files and often steals data first for double extortion |
| Infostealer | Credential and data theft | Harvests browser passwords, session cookies and crypto wallets |
| Remote access trojan | Persistent control | Opens a hidden channel for commands, screenshots and file transfer |
| Rootkit | Concealment | Hides files, processes or network activity, sometimes at kernel level |
| Botnet agent | Resource abuse at scale | Joins a centrally controlled network for spam or denial of service |
| Cryptominer | Theft of computing power | Mines cryptocurrency and causes sustained high CPU or GPU load |
| Wiper | Destruction | Overwrites data or boot records, sometimes disguised as ransomware |
| Spyware and keyloggers | Surveillance | Records keystrokes, messages, location or audio |
A growing share of attacks uses fileless techniques, which run code in memory through built-in tools such as PowerShell or WMI. This approach, called living off the land, leaves few files on disk and blends with normal administrative activity, which defeats purely file-based scanning.
How malware reaches a system
Malware needs an initial access vector before it can run. The table links the most common vectors to the mechanism they exploit and to the control that most reduces their risk.
| Vector | Mechanism | Most effective control |
|---|---|---|
| Phishing attachments and links | The user opens a document, archive or fake login page | Email filtering, macro blocking and user training |
| Exploited vulnerabilities | Unpatched internet-facing services run attacker code | Fast patching of known exploited flaws |
| Stolen credentials | Attackers log in to VPN or remote desktop services | Multi-factor authentication |
| Software supply chain | A trusted update or package carries malicious code | Vendor assessment, code signing and integrity checks |
| Drive-by downloads and malicious ads | A compromised or fake website delivers a payload | Browser updates and web filtering |
| Removable media | Infected USB drives introduce code into isolated networks | Device control and disabled autorun |
Once running, malware typically pursues persistence, privilege escalation and lateral movement. Frameworks such as MITRE ATT&CK catalog these behaviors as tactics and techniques, which gives defenders a common language for detection coverage.
Detecting and analyzing malware
No single detection method catches all malware, because attackers use packing, obfuscation and polymorphism to change how their code looks while keeping its behavior. Effective defense layers several methods with different strengths.
| Method | Strength | Weakness |
|---|---|---|
| Signature matching | Fast and precise for known samples | Misses new or modified variants |
| Heuristic and rule-based analysis | Detects suspicious structures, for example with YARA rules | Higher false-positive rate |
| Behavioral monitoring (EDR) | Detects malicious actions regardless of file form | Requires tuning and skilled analysts |
| Sandbox detonation | Observes real behavior in isolation | Evasive samples detect the sandbox and stay dormant |
| Machine learning classifiers | Generalizes to unseen samples | Can be evaded by adversarial modifications |
Analysts distinguish static analysis, which inspects code without running it, from dynamic analysis, which observes execution in a controlled environment. The results are distilled into indicators of compromise, such as file hashes, domains and IP addresses, which are short-lived, and into behavioral detections, which remain useful far longer.
Reducing the impact of malware
Because some malware will eventually run, mature organizations design for containment and recovery, not only prevention. The most effective measures are well established:
- Patch known exploited vulnerabilities first, especially on internet-facing systems.
- Remove local administrator rights and apply least privilege, which blocks many persistence and escalation techniques.
- Use application allowlisting on servers and high-value workstations.
- Keep offline or immutable backups and test restores regularly, because ransomware operators target backup systems deliberately.
- Segment networks so that a single infected host cannot reach every server.
A common mistake is to treat a cleaned machine as trustworthy. After an infection with a rootkit or a remote access trojan, the safe practice is to rebuild the system from a known-good image and reset every credential that was used on it.
Understanding it simply
Malware is software made to cause harm. It can sneak in through an email attachment, a fake website or an unpatched program, and then it works quietly in the background against the computer’s owner.
Some malware locks files and demands money, some steals passwords, and some lets criminals control the computer from afar. The best protection combines several habits: keeping software updated, being careful with unexpected attachments and keeping backups that an attacker cannot reach.
Applied in practice
An accounting firm with 120 employees receives an email with a compressed invoice attachment. One employee opens it, and a script inside launches a loader that downloads an infostealer. Within minutes, the infostealer collects saved browser passwords and attempts to contact a remote server.
The firm’s endpoint detection and response agent flags the unusual sequence of a script spawning PowerShell and making an outbound connection. It isolates the laptop from the network 14 minutes after the attachment was opened. The security provider rebuilds the laptop, resets the employee’s passwords and checks for logins from unknown locations. A review shows that the same campaign later delivered ransomware to similar firms, so early behavioral detection prevented a far more costly incident.