Malware

Also known as: Malicious software

Any software intentionally built to damage, disrupt, or gain unauthorized access to a system — including viruses, worms, ransomware, trojans, and spyware.

Last updated: April 21, 2026

What is malware?

Malware (short for "malicious software") is any program or code written to harm, spy on, or take control of the system it lands on. The term is a catch-all that covers several functional categories:

Viruses attach to legitimate programs and spread when the host executes
Worms self-propagate across networks without requiring user action
Trojans masquerade as legitimate software to trick the user into running them
Ransomware encrypts the victim's files and demands payment for the key
Spyware silently collects credentials, keystrokes, or screenshots
Rootkits hide other malware from detection tools by subverting the OS
Cryptominers use the victim's CPU/GPU to mine cryptocurrency

Most modern malware blends these categories — a single sample may start as a trojan, drop ransomware, and exfiltrate data to a command and control server.

How malware reaches a target

Common delivery paths: phishing emails with macro-laced attachments or malicious links, drive-by downloads from compromised websites, USB drops, software-supply-chain compromises (a legitimate update gets backdoored), and exploitation of unpatched public-facing services. Once executed, malware typically establishes persistence (survive reboots), beacons out to C2 infrastructure for instructions, and spreads laterally inside the network.

Detection from IP data

A host that suddenly starts making outbound connections to known-malicious IPs is one of the clearest signs of active malware on the network. Endpoint detection (EDR) catches file and behavior signatures; network-level detection catches the C2 beacons. Running suspicious destination IPs through an IP abuse report checker confirms whether a host is already flagged as malware infrastructure.

Frequently Asked Questions

The main categories are viruses (attach to other programs), worms (self-propagate across networks), trojans (disguise as legitimate software), ransomware (encrypt files for payment), spyware (silent data theft), rootkits (hide other malware), and cryptominers (steal CPU to mine crypto). Most modern samples blend several of these.

The most common paths are phishing emails with malicious attachments or links, drive-by downloads from compromised websites, pirated or trojanized software, unpatched public-facing services being exploited remotely, and — less often — USB drops or supply-chain attacks where a legitimate update is backdoored at the source.

Yes. Android is the primary target because sideloading is easy — fake banking apps, SMS-hijack trojans, and stalkerware are common. iOS is harder to infect outside of state-level zero-click exploits but not immune. Installing apps only from official stores and keeping the OS current blocks the overwhelming majority of mobile malware.

On a consumer machine, run a reputable endpoint scanner in safe mode, remove the detected items, then change every password from a known-clean device. For persistent infections (rootkits, ransomware), the reliable fix is a full OS reinstall from trusted media. On enterprise endpoints, follow the IR playbook: isolate, image, remediate, restore from backup.

Malware is the umbrella term for any malicious software. A virus is one specific type of malware that inserts itself into another program and spreads when that host program runs. Worms, ransomware, and trojans are also malware but are not viruses. In everyday speech people still say "computer virus" to mean any malware.

Back to glossary