What Is Malware? Types, Examples, and How to Stay Protected

Malware is malicious software designed to damage, disrupt, or gain unauthorised access to computer systems. From viruses and ransomware to spyware and rootkits — learn how each type works and how to protect yourself.

What Is Malware?

Malware (short for malicious software) is any software intentionally designed to cause damage, disrupt systems, steal data, or gain unauthorised access to computers and networks. It is one of the most common and costly threats in cybersecurity-the-internets-core-protocol)-the-backbone-of-reliable-internet-communication).

Malware can be delivered through phishing emails, malicious downloads, infected USB drives, compromised websites, and vulnerabilities in unpatched software.

Types of Malware

1. Virus

A virus attaches itself to a legitimate file or program and spreads when that file is executed or shared. Like a biological virus, it replicates by infecting other files.

  • Requires human action to spread (opening an infected file)
  • Can corrupt files, display messages, or delete data
  • Example: ILOVEYOU (2000) — spread via email, overwrote files on millions of computers

2. Worm

A worm is self-replicating malware that spreads automatically across networks without requiring human interaction. It exploits vulnerabilities in operating systems or applications.

  • No host file needed — it is a standalone program
  • Can consume bandwidth, install backdoors, or carry other payloads
  • Example: WannaCry (2017) — spread via EternalBlue SMB exploit, encrypted files globally

3. Trojan Horse

A Trojan disguises itself as legitimate software to trick users into installing it. Once executed, it performs hidden malicious actions.

  • Does NOT self-replicate (unlike viruses and worms)
  • Often creates backdoors for remote access-how-virtual-private-networks-work)
  • Example: Emotet — delivered as fake invoice emails, later used to install ransomware

4. Ransomware

Ransomware encrypts the victim's files and demands payment (ransom) for the decryption key. Modern ransomware also exfiltrates data and threatens to publish it (double extortion).

Victim files: Accessible
After ransomware: All files encrypted → .locked extension
Ransom note: "Pay 3 BTC to restore your files"
  • Targets individuals, hospitals, schools, governments
  • Examples: WannaCry, REvil, LockBit, BlackCat
  • Prevention: Regular offline backups; patch management-cves-exploits-and-patch-management); email filtering

5. Spyware

Spyware secretly monitors user activity and sends data to attackers — browsing history, keystrokes, screenshots, or credentials.

  • Often bundled with free software or browser extensions
  • Operates silently in the background
  • Example: FinFisher — commercial spyware used by governments to monitor citizens

6. Adware

Adware automatically displays unwanted advertisements and may collect browsing data to target ads. The boundary between adware and spyware is often blurred.

  • Typically less damaging but degrades performance and privacy
  • Often included in free software as a monetisation mechanism

7. Keylogger

A keylogger records every keystroke typed on the keyboard, capturing passwords, credit card numbers, and messages without the victim's knowledge.

  • Can be software or hardware (physical device attached to keyboard port-the-internets-core-protocol)-and-UDP-ports-explained))
  • Often deployed as part of spyware or banking trojans
  • Defence: MFA-explained), virtual keyboards for sensitive inputs, anti-malware

8. Rootkit

A rootkit hides the presence of malware by subverting the operating system's visibility mechanisms. It can hide files, processes, registry keys, and network connections.

  • Extremely difficult to detect and remove
  • Often requires a full OS reinstall or boot-level scanner
  • Example: Sony BMG rootkit (2005) — hidden on music CDs, installed on millions of PCs

9. Botnet (Bot)

A botnet is a network of compromised computers (bots) controlled remotely by an attacker (botmaster). Bots are used for DDoS attacks, spam campaigns, crypto mining, and credential stuffing-explained)).

Attacker → Command & Control Server → 100,000+ infected bots → DDoS target
  • Victims often unaware their machine is part of a botnet
  • Example: Mirai botnet-attack-distributed-denial-of-service-explained) — compromised IoT devices, launched massive DDoS attacks

10. Cryptojacker

Cryptojackers hijack computing resources to mine cryptocurrency for the attacker without the victim's knowledge.

  • Slows device performance significantly
  • Hides as a legitimate process or runs in browsers via JavaScript
  • Detection: High CPU usage for no apparent reason

How Malware Gets In — Infection Vectors

| Vector | Description | |--------|-------------| | phishing emails | Malicious attachments or links in emails | | Drive-by downloads | Visiting a compromised website triggers a download | | Malvertising | Malicious ads on legitimate sites | | USB / removable media | Infected drives auto-run on insertion | | Software vulnerabilities | Exploiting unpatched flaws | | Supply chain attacks | Malware inserted into legitimate software updates |

How to Protect Against Malware

| Defence | Why It Works | |---------|-------------| | Keep software updated | Patches close exploited vulnerabilities | | Use reputable anti-malware | Detects known malware signatures and behaviours | | Email filtering | Blocks malicious attachments and links | | Regular backups (offline/offsite) | Enables recovery from ransomware without paying | | Principle of least privilege | Limits damage if an account is compromised | | MFA-explained) | Prevents stolen credentials from being used | | network segmentation-virtual-local-area-network-explained) | Contains spread if one system is infected | | User training | Teaches staff to spot phishing and social engineering |

Quick Recap

  • Malware is a broad term for malicious software including viruses, worms, trojans, ransomware, spyware, and more
  • Ransomware is the most financially damaging type — encrypts files and demands payment
  • Rootkits are the hardest to detect — they hide other malware from the OS
  • Botnets coordinate thousands of infected machines for attacks
  • Regular backups, updates, and user training are your most important defences