A Trojan, or Trojan horse, is malware that disguises itself as legitimate software and depends on a user or administrator to install or run it, after which it performs hidden actions the victim never authorized. In cybersecurity, and within the study of malware and attacks in particular, the defining trait of a Trojan is deception rather than self-propagation: unlike a virus or a worm, it does not copy itself to other files or machines on its own.
The name describes the delivery method, not the payload. A Trojan may steal credentials, open a backdoor, download ransomware, enlist the machine in a botnet or log keystrokes. What unites these variants is the gap between what the program claims to do and what it actually does, and that gap is what defenders try to detect and close.
How a Trojan reaches and compromises a system
A Trojan compromises a system in a sequence of stages, and each stage is a point where defenders can interrupt it. The attacker first needs a convincing lure, then a way to get the victim to execute the file, and finally a way to stay on the machine and communicate with an operator.
The lure is usually a fake installer, cracked software, a malicious document or a counterfeit update. Delivery often begins with phishing, a poisoned search result or a compromised download site. Once executed, the first component is frequently a small dropper or loader whose only job is to fetch and decrypt the real payload, which keeps the initial file small and harder to classify.
The table below maps the typical stages of a Trojan infection to the defensive controls that act on each one.
| Stage | What happens | Typical defensive control |
|---|---|---|
| Lure | Victim receives or finds a disguised file | Email filtering, user awareness |
| Execution | Victim opens the file or grants permissions | Application allowlisting, macro blocking |
| Staging | Loader downloads and decrypts the payload | Network filtering, sandbox analysis |
| Persistence | Registry keys, scheduled tasks or services are created | Endpoint monitoring, configuration baselines |
| Command and control | Malware beacons to an attacker server | DNS and proxy inspection, egress rules |
| Action on objectives | Data theft, remote control or further malware | Data loss prevention, segmentation |
Persistence mechanisms matter because they decide how long the compromise lasts. Common choices on Windows include Run registry keys, scheduled tasks, services and DLL search-order hijacking; on Linux and macOS, cron jobs, systemd units and launch agents serve the same purpose.
Common types of Trojans by payload
Trojans are classified by what the hidden payload does, because the delivery trick is shared across families. A single sample often combines several functions, and modular Trojans can receive new capabilities from their operator after installation.
| Type | Main function | Typical impact |
|---|---|---|
| Remote access Trojan | Gives the attacker interactive control | Full system compromise, surveillance |
| Banking Trojan | Intercepts sessions and injects web forms | Financial fraud, stolen accounts |
| Infostealer | Harvests saved passwords, cookies and tokens | Account takeover, session hijacking |
| Downloader or loader | Installs additional malware on demand | Ransomware or botnet deployment |
| Backdoor | Opens a hidden access channel | Long-term unauthorized access |
| Mobile Trojan | Abuses app permissions on phones | SMS fraud, intercepted one-time codes |
Infostealers have become especially important because stolen browser cookies and session tokens can bypass multi-factor authentication for as long as the session remains valid. The credentials they collect are frequently sold and later reused in credential stuffing campaigns.
How a Trojan differs from related threats
A Trojan differs from other malware mainly in how it spreads and how it hides. The terms overlap in practice, since one attack chain may use a Trojan to deliver a rootkit or ransomware, so precise classification looks at each component separately.
| Concept | Spreads by itself | Primary trait |
|---|---|---|
| Trojan | No | Disguise that requires user execution |
| Virus | Yes, by infecting files | Attaches to host programs |
| Worm | Yes, across networks | Exploits vulnerabilities automatically |
| Rootkit | No | Conceals malware at a privileged level |
| Ransomware | Varies | Encrypts data for extortion |
| Botnet agent | Varies | Joins a centrally controlled network |
The broader category, malware, covers all of these. Phishing is often the delivery channel for a Trojan rather than a competing concept, which is why email security and endpoint protection are usually evaluated together.
Detecting and preventing Trojan infections
Effective defense against Trojans relies on layered controls, because no single tool reliably recognizes a well-disguised new sample. Signature-based antivirus catches known families, while behavioral detection looks for actions such as unexpected process injection, credential store access or unusual outbound connections.
The following table links practical measures to the attack stage they address and to their main limitation.
| Measure | What it stops | Main limitation |
|---|---|---|
| Application allowlisting | Execution of unapproved programs | Administrative effort to maintain |
| Endpoint detection and response | Suspicious behavior after execution | Requires skilled alert triage |
| Least privilege accounts | System-wide changes by the payload | Does not stop user-level data theft |
| Code signing checks | Unsigned or tampered installers | Stolen certificates sign malware too |
| Egress filtering | Command and control traffic | Encrypted traffic to cloud services blends in |
Software from official sources only remains one of the most effective rules for end users, together with keeping macros disabled in documents from outside the organization. For administrators, removing local administrator rights sharply reduces what a Trojan can achieve after it runs.
Common misconceptions and response mistakes
Several widespread beliefs about Trojans lead to weak defenses or incomplete cleanup. The most important ones concern trust in signatures, file types and the effect of removal tools.
- A digital signature is not proof of safety, because attackers sign malware with stolen or fraudulently obtained certificates.
- Documents and archives can carry Trojans, not only executable files, through macros, scripts and embedded shortcuts.
- Deleting the visible file rarely ends the compromise, since persistence entries and secondary payloads usually remain.
- Stolen credentials stay dangerous after cleanup, so passwords and session tokens must be revoked and reset.
- Mobile devices are not immune, especially when apps are sideloaded from outside official stores.
For a confirmed infection on a business machine, the safer practice is reimaging the system from a trusted baseline rather than attempting manual removal, combined with a review of what accounts and data the machine could reach.
The idea in brief
A Trojan is a harmful program dressed up as something useful, much like the wooden horse in the old story that carried soldiers inside a gift. It might look like a free game, an invoice or a software update. The danger is that you open the door yourself.
Once it runs, it quietly does something else in the background, such as copying your passwords or letting a stranger control the computer. Downloading software only from trusted sources and being careful with unexpected attachments prevents most of these infections.
A practical scenario
An accountant at a mid-sized firm searches for a free PDF editor and downloads an installer from a site that appears near the top of the results. The installer works and the editor opens normally, but it also drops a loader that fetches an infostealer. Within minutes the stealer collects saved browser passwords and session cookies, including an active session for the company payroll portal.
The firm’s endpoint detection tool flags an unusual process reading the browser credential database and isolates the laptop from the network. The security team reimages the machine, revokes all active sessions and resets the exposed passwords before the stolen cookies are used. The incident leads the company to remove local administrator rights and to allow only approved software installations, which closes the path the Trojan used.