What Is Malware? How Malicious Software Gets In, What It Does, and How to Stop It
Learn what malware is, how different types of malicious software spread, what attackers want malware to do, and how systems get infected in the first place.
Malware is one of those security terms that gets used as though it describes one particular kind of attack.
It doesn’t.
Malware is short for malicious software, and it is the broad category for software deliberately created to damage systems, disrupt operations, steal information, spy on users, extort money, or gain access that the attacker should not have, the same broad definition reflected in CISA’s malware overview.
A virus is malware. A worm is malware. Ransomware and spyware are malware too. What separates them is not whether they are malicious, but how they behave, how they spread, and what the attacker wants them to accomplish.
Malware can target desktop computers, servers, phones, cloud environments, and entire corporate networks. Sometimes the goal is obvious, such as encrypting thousands of files and demanding money. Other malware tries to remain invisible for months while quietly stealing credentials or monitoring activity.
The basic attack often follows a familiar pattern:
Delivery
↓
Malware executes
↓
Establishes access
↓
Performs malicious activity
↓
May spread, persist, steal, encrypt, or disrupt
Understanding malware therefore means looking at two things separately: what the malware does once it runs, and how it managed to run in the first place.
Malware Is Software With a Malicious Purpose
Ordinary software performs actions on behalf of its user or administrator. Malware performs actions for the benefit of an attacker.
Those actions can vary enormously.
Some malware destroys or modifies files. Some steals passwords and financial information. Some gives an attacker remote control of the infected machine, while other malware turns thousands of infected computers into part of a larger network that can be controlled together.
The same malware may perform several functions at once. A malicious program could steal credentials, download additional components, disable security tools, and then provide persistent remote access.
This is why the familiar categories—virus, worm, Trojan, ransomware, spyware—are useful descriptions rather than perfectly separate boxes. Real attacks can combine techniques.
For example, ransomware describes the attacker’s purpose and behavior, while a worm describes a method of spreading. Ransomware could therefore include worm-like capabilities that help it move through a network.
The name tells you something about the malware, but rarely tells you everything, especially because real delivery paths often overlap with phishing.
Viruses Attach Themselves to Other Files
A computer virus is malware that attaches itself to another file or program and spreads by infecting additional files.
The comparison with a biological virus is where the name comes from. The malicious code depends on a host and reproduces by infecting other suitable hosts.
A simplified flow might be:
Infected file
↓
User runs file
↓
Virus executes
↓
Other files become infected
↓
Those files may spread elsewhere
This usually requires some form of execution or user activity. Someone might open an infected file, copy it to another system, or share it with another person.
Once running, the virus may do much more than replicate. It can corrupt information, modify software, install other malicious components, or perform whatever payload its creator designed.
The important characteristic is the infection mechanism: a virus attaches itself to other files or programs and relies on those hosts as part of its spread.
That is different from a worm.
Worms Can Spread Automatically
A worm is designed to replicate and spread between systems, often without requiring someone to manually copy an infected file from one machine to another.
This makes worms particularly dangerous on networks.
A worm might discover another vulnerable computer, exploit a software weakness, copy or execute itself there, and then repeat the process from the newly infected machine.
That can create rapid propagation:
Computer A
│
├──► Computer B
│ ├──► Computer D
│ └──► Computer E
│
└──► Computer C
└──► Computer F
A vulnerability that exists across thousands of computers can therefore give a worm an enormous number of potential targets.
The spread itself can cause disruption because infected machines consume network and computing resources. The worm may also carry another payload, such as ransomware or software that provides remote access.
This is why security updates matter so much. A vulnerability is dangerous on one machine; a remotely exploitable vulnerability shared by an entire fleet of machines can become a pathway for automated propagation, which is why CISA’s Known Exploited Vulnerabilities Catalog is so operationally important.
Trojans Win by Looking Legitimate
A Trojan, or Trojan horse, takes a different approach.
Instead of spreading primarily by infecting other files or automatically exploiting machines, a Trojan disguises itself as legitimate or desirable software so that someone is persuaded to install or run it.
The file might pretend to be a useful application, software update, game, document, browser extension, or cracked version of commercial software.
The user thinks they are doing this:
Download useful program
↓
Install program
but the real result is:
Download apparent program
↓
Run it
↓
Malicious code executes
The Trojan may then steal information, create a backdoor, install additional malware, or give an attacker control over the machine.
The name comes from the Trojan horse story: the dangerous part gets inside because it appears to be something worth accepting.
That makes Trojans closely connected to social engineering. The attacker does not necessarily need to break through a technical defense if they can convince someone to open the door themselves, a relationship that becomes clearer alongside what phishing is.
Ransomware Turns Data Into Leverage
Ransomware is malware designed to extort its victim.
The classic form searches for valuable files and encrypts them so the victim can no longer access the information. The attacker then demands payment, typically promising a decryption mechanism in return.
The attack can turn:
Documents
Databases
Shared folders
Backups
into inaccessible encrypted data.
Modern ransomware attacks can go further. Attackers may steal information before encrypting systems and threaten to publish it if the victim refuses to pay. That creates two forms of pressure: loss of access and potential disclosure.
In business environments, ransomware can become much more serious than losing files on one laptop. If the attacker reaches shared storage, servers, identity systems, or other critical infrastructure, entire operations can be disrupted.
Backups are therefore an important ransomware defense, but simply having “a backup” is not enough. If malware can access and destroy the backup from the compromised environment, the backup may disappear along with the original data.
Useful recovery planning requires protected backups and, just as importantly, testing that those backups can actually be restored.
Ransomware demonstrates why malware defense cannot rely entirely on prevention. Organizations also need to prepare for what happens if prevention fails.
Spyware Tries Not to Be Noticed
Ransomware wants your attention. Spyware generally wants the opposite.
Spyware secretly collects information about a device or its user and sends that information to another party.
Depending on the malware, it might monitor browsing activity, collect credentials, capture communications, inspect files, track activity, or gather information about the device itself.
For spyware, remaining undetected can be extremely valuable. The longer the malware survives, the longer the attacker may be able to collect information.
That creates a different failure pattern from destructive malware.
A computer can appear to work normally while still being compromised.
There may be subtle warning signs—unexpected network connections, unusual processes, reduced performance—but sophisticated malware may deliberately attempt to blend into normal system activity.
The absence of obvious pop-ups or crashes therefore does not prove that a device is clean.
Keyloggers Capture What You Type
A keylogger is a more specific form of monitoring that records keyboard input.
That can expose sensitive information such as usernames, passwords, messages, searches, or other text entered on the compromised device.
Conceptually:
User types
↓
Keystrokes captured
↓
Malware stores/transmits them
↓
Attacker receives information
Keylogging can be implemented in different ways, including software and hardware, so not every keylogger is technically the same type of malware. In malware discussions, however, the term commonly refers to malicious software designed to capture keyboard activity.
A keylogger also demonstrates an important limitation of encryption.
HTTPS can protect a password while it travels between a browser and a website. But if malware captures the password before the browser encrypts and sends it, network encryption does not solve the problem, which is why SSL certificate chains and transport security still cannot secure an already compromised endpoint.
Security therefore has to protect endpoints as well as communication between them.
Phishing Is One of the Ways Malware Gets Through the Door
Malware needs some way to reach and execute on the target.
Phishing emails are a common delivery mechanism because they attack people as well as technology.
An email may pretend to contain an invoice, delivery notice, security warning, shared document, job application, or message from someone the recipient knows. The attacker wants the victim to open a malicious attachment, follow a harmful link, install software, or otherwise perform an action that leads to compromise.
The technical attack and the social attack work together.
A malicious attachment that nobody opens is far less useful to an attacker. A convincing message increases the chance that someone will execute it.
This is why suspicious-email advice should go beyond “look for bad spelling.” Modern phishing can be professionally written and may impersonate legitimate organizations convincingly.
Unexpected attachments, unusual login requests, mismatched destinations, urgent demands, and requests to bypass normal procedures are more useful warning signals.
Downloads and Compromised Websites Can Deliver Malware Too
Email is only one route.
Malware can be hidden inside software downloaded from untrusted sources, fake installers, pirated applications, malicious browser extensions, or software pretending to be a legitimate update.
A compromised or malicious website can also participate in an attack. It may attempt to trick visitors into downloading something, redirect them elsewhere, exploit a browser or plugin vulnerability, or display fake security warnings designed to provoke an installation.
This makes the source of software important.
Downloading an application from an unknown mirror, advertisement, file-sharing site, or unsolicited link creates a different risk from obtaining it through a trusted vendor or controlled application store.
Even then, no source should be treated as magically safe. Software supply chains can themselves be compromised.
The goal is to reduce unnecessary exposure rather than assume one precaution can eliminate every possibility.
Vulnerabilities Can Remove the Need for a Click
Not every malware infection depends on someone making an obvious mistake.
Attackers can exploit software vulnerabilities, the same broader weakness category that OWASP documents across web and application security.
A vulnerability is a weakness in software that allows behavior the developer did not intend. Depending on the flaw, an attacker may be able to execute code, gain additional privileges, bypass security controls, or move from one system to another.
This is especially dangerous when the vulnerable service is reachable over a network.
The attack can become:
discover vulnerable system → exploit vulnerability → execute malware → establish access
No malicious attachment needs to be opened.
This is why patching is one of the least glamorous but most important malware defenses. Once a security update is available, leaving the vulnerable software unchanged can preserve an attack path that already has a known fix.
Updates do not prevent every attack, particularly when a vulnerability is not yet known or patched, but they remove many opportunities attackers would otherwise continue to exploit.
Infection Does Not Always Mean Immediate Damage
Once malware executes, it may attempt to establish persistence so that it survives restarts or continues operating over time.
It might also communicate with external infrastructure, download additional malware, collect system information, steal credentials, or attempt to move to other computers on the network.
That means the first infected device can be only the beginning.
In a business network, an attacker may compromise one employee laptop and then use credentials or vulnerabilities to reach file servers, administrative systems, cloud accounts, or other devices.
The progression can become:
Initial infection
↓
Establish persistence
↓
Steal credentials
↓
Move through network
↓
Reach valuable systems
↓
Steal / encrypt / disrupt
This is why detecting an infected computer is not always enough. Security teams may need to determine what the malware did, how long it was present, which credentials were exposed, and whether the attacker reached other systems.
Removing the original malicious file does not necessarily remove everything that happened after it ran.
The Signs of Malware Are Useful, but Not Proof
Malware can produce visible symptoms.
A computer may become unexpectedly slow, display unusual pop-ups, crash repeatedly, launch unfamiliar applications, change browser settings, or generate strange network activity.
Other possible warning signs include unexplained storage usage, disabled security software, unexpected account activity, or programs starting without an obvious reason.
These symptoms deserve investigation, but they are not unique to malware.
A slow computer may simply be running out of memory. Crashes can come from faulty hardware or buggy software. High network traffic might be caused by a legitimate backup.
The reverse is also true: a machine can be infected without appearing slow or unstable.
Well-designed spyware has little incentive to announce itself with a giant pop-up saying the system has been compromised.
So symptoms are signals, not a reliable malware test.
Antivirus and Anti-Malware Tools Look for Malicious Activity
Antivirus and anti-malware software can detect and block known or suspicious malicious programs.
Historically, antivirus products relied heavily on signatures: recognizable patterns associated with known malware. If a file matched a known malicious signature, the security software could quarantine or remove it.
Modern endpoint security can use a wider range of techniques, including behavioral analysis, reputation information, machine learning, process monitoring, and detection of suspicious activity.
That matters because attackers can modify malware to avoid simple exact-file matching.
Security software can provide an important layer of defense, but it should not be treated as an impenetrable shield. New malware, unusual attack techniques, compromised credentials, and previously unknown vulnerabilities can still create problems.
The safer model is defense in depth: multiple controls that reduce the chance that one failure becomes a complete compromise, a mindset also central to zero trust security.
Updates Close Known Paths Into the System
Keeping operating systems, browsers, applications, plugins, network devices, and security software updated reduces exposure to known vulnerabilities, and NIST guidance on the Protect function treats that upkeep as a core defensive practice.
This matters because attackers do not always need sophisticated new techniques. If thousands of computers still expose an old vulnerability with a publicly known exploit, those machines remain attractive targets.
Updates can also improve built-in malware protections, certificate stores, browser isolation, exploit mitigations, and other security components.
Businesses face an additional challenge because patching one laptop is easy compared with patching thousands of endpoints, servers, applications, and network devices without disrupting operations.
That turns patch management into an operational discipline: knowing what software exists, which vulnerabilities affect it, how urgent the risk is, and whether the update was actually deployed.
“Automatic updates enabled” is helpful, but organizations still need visibility into systems that cannot update automatically or have fallen outside normal management.
Firewalls Reduce Unwanted Network Access
A firewall controls network traffic according to defined rules, whether it is a local host firewall or part of a broader boundary design such as VPN and segmented enterprise networks.
It can block unnecessary inbound connections, restrict communication between network segments, or prevent certain types of traffic from crossing a security boundary.
This can make some malware attacks harder.
For example, if a worm attempts to spread by connecting to a vulnerable network service, firewall rules may prevent that connection from reaching other systems.
Firewalls can also help contain an infection by limiting which systems an infected machine can contact.
But a firewall is not a general malware remover.
If someone downloads a malicious application through traffic the firewall legitimately allows, the malware may still execute. Likewise, a firewall cannot undo a user giving credentials to a phishing site.
Again, the controls complement each other.
Firewalls restrict network paths. Anti-malware tools inspect endpoints. Updates remove vulnerabilities. Authentication protects accounts. Backups support recovery.
No single one replaces the others.
Backups Protect Recovery, Not the Original Infection
Backups deserve special attention because they solve a different part of the problem.
Antivirus attempts to prevent or detect malware. A firewall attempts to restrict network activity. Updates attempt to remove vulnerabilities.
A backup assumes that despite those controls, something may still go wrong.
If ransomware encrypts important files or destructive malware corrupts them, a clean backup may allow the organization to restore the lost information.
That only works if the backup itself survives.
Critical backups should therefore be protected from the same credentials and systems that an attacker may compromise. Organizations also need multiple restore points in case malware or corrupted data existed for some time before anyone noticed.
Most importantly, recovery needs to be tested, which is why guidance like CISA’s ransomware recovery recommendations emphasizes restoration planning rather than assuming backups will work when the pressure is real.
A backup job reporting “successful” is not the same thing as proving that the organization can rebuild a system when production data disappears.
Cautious Behavior Removes Easy Opportunities
Technical controls matter, but many malware attacks still depend on persuading someone to perform an unsafe action.
Basic caution can remove a surprising number of opportunities.
Software should come from trusted sources. Unexpected attachments and downloads deserve suspicion. Security warnings should be investigated rather than bypassed automatically, and requests to disable antivirus protection before installing something are a particularly strong warning sign.
Email links deserve similar care, especially when a message creates artificial urgency.
This does not mean users should be expected to identify every sophisticated attack. Security that depends entirely on nobody ever clicking the wrong thing will eventually fail.
Organizations should design systems so that one mistaken click does not automatically give an attacker unrestricted access to everything.
Limited user privileges, application controls, network segmentation, multi-factor authentication, endpoint protection, and secure backups all reduce the consequences when human judgment fails.
Malware Defense Is Really About Breaking the Attack Chain
It is easy to frame malware security as a battle between malicious software and antivirus software.
Real defense is broader.
An attack may need to reach the device, execute code, establish access, obtain useful privileges, communicate with external systems, spread through the network, and reach valuable data before it achieves its final objective.
Defenders have opportunities to interrupt that process at every stage.
Phishing / exploit / download
↓
execution
↓
persistence
↓
credential or data access
↓
network movement
↓
theft / encryption / damage
Email filtering may stop the initial delivery. Patching may make the exploit fail. Endpoint protection may block execution. Limited privileges can restrict what the malware can do, while firewalls and segmentation can make movement harder. Monitoring can expose unusual behavior, and protected backups can reduce the damage if ransomware reaches important data.
That layered approach matters because no individual defense catches everything.
Malware is malicious software designed to damage, disrupt, spy on, steal from, or gain unauthorized access to systems. Viruses, worms, Trojans, ransomware, spyware, and keyloggers differ in how they spread and what they do, but defending against them follows the same deeper principle: reduce the ways malicious code can get in, limit what it can reach if it does, detect abnormal behavior quickly, and maintain a recovery path for the day prevention fails.