# What is malware? Malware is malicious code or software designed to compromise devices, applications, servers or networks. It can steal data, interfere with systems or disrupt access to them. The best-known types of malware include viruses, Trojans and worms. ### Key Takeaways - Malware is a general term for malicious software designed to compromise devices, steal data or disrupt systems. - It can get onto a computer through email attachments or links, infected downloads, compromised websites or outdated software. - Common types include viruses, worms, Trojans, ransomware, spyware, infostealers and scareware. - Well-known examples include ILOVEYOU, Emotet, MyDoom, WannaCry, Pegasus and the BKA Trojan. - Antivirus software and firewalls reduce the risk, but they don’t replace regular updates, backups, access controls or security training. ## What is malware? Malware is a **general term for malicious software** that can get onto a device and perform unwanted actions. The name comes from a combination of ‘MALicious’ and ‘softWARE’. Unlike ordinary software bugs, malware is designed to cause harm. For example, a program might crash because it isn’t compatible with an operating system. Malware, on the other hand, is deliberately created to infiltrate devices or networks and cause damage. Sometimes it goes undetected for a long time, causing serious harm before anyone notices. Antivirus software and firewalls can significantly reduce the risk, but they don’t replace regular updates, backups, access controls or security training. ## How does malware get onto a computer? Malware can get onto a computer in several ways, even when you have [security measures](https://www.ionos.com/en-ie/digitalguide/server/security/protection-against-ransomware-spyware-and-scareware/) in place. One of the most common ways is through **email attachments or links** that run malicious code when opened. Downloading infected software from untrustworthy sources is another major risk. Malware can also spread through compromised websites, security vulnerabilities in outdated software or external storage devices such as USB drives. Attackers often use social engineering to trick people into running malware themselves. These days, malware is often just one part of a larger attack. Criminals might steal login credentials, sell access to compromised systems, extract data and then deploy ransomware or use the stolen information for extortion. ## What are the different types of malware? There are several types of malware, and they don’t all work the same way. Understanding how a malicious program works and what it’s designed to do is important when deciding how to deal with it. Viruses, Trojans and worms have been around for decades, but malware has evolved since then. Ransomware and spyware are now major threats, and many malicious programs combine different techniques. Let’s look at the main types of malware and how they work. ### Computer viruses People often use the word ‘virus’ to describe any kind of malware, but viruses are actually just one type. What sets them apart is how they spread: they **make copies of themselves** and attach to other files or programs to infect other parts of a computer or network. Viruses can do different things. Some slow down, disrupt or even destroy systems, while others secretly steal information. Computer viruses are less common today than other types of malware such as ransomware and Trojans, but they’re still one of the basic types of malware. ### Computer worms Computer worms work in a similar way to viruses, but there’s one key difference: while viruses attach themselves to other files, worms **don’t need a host file**. Worms can make copies of themselves and spread automatically, quickly infecting other systems through networks or security vulnerabilities. They can cause serious damage by copying data, slowing down systems or downloading additional malware. Worms spread mainly through networks, but they can also spread through email, messaging apps or external storage devices. ### Trojan horse A Trojan horse, or simply a Trojan, is a type of malware that disguises itself as a harmless or even useful program. Its name comes from the wooden horse in Greek mythology, which Greek soldiers used to sneak into the city of Troy. Once installed, a Trojan can secretly monitor the infected system, copy data, change system settings or open the door for other malware. Some Trojans even allow attackers to control the computer remotely. Unlike viruses and worms, Trojans generally don’t spread on their own. Instead, attackers usually trick people into installing them. ### Ransomware Ransomware typically infects a system through security vulnerabilities or by tricking people into installing it. Once inside, it can **encrypt files or block access to the device**. The attackers then demand a ransom to restore full access to the system. That’s where the name ‘ransomware’ comes from. Many modern variants also steal data and threaten to publish it if the ransom isn’t paid. Paying the ransom is generally not recommended because there’s no guarantee the attackers will actually restore access to the data. Instead, you can try to remove ransomware using specialised security software. Once the system is clean, you can restore affected data from a clean backup. However, removing ransomware doesn’t always reverse the damage. Even after the malware is gone, the affected files will usually remain encrypted. ### Spyware Spyware is a type of malware that **secretly spies on people** and collects information from their computers or other devices. The information can then be used by the attackers themselves or shared with third parties. Spyware can also affect how a computer works. It may slow down the system, change settings or download additional malware. ### Infostealer Infostealers are a type of malware designed to **steal login credentials and other sensitive information** from infected devices. They typically target: - saved passwords - browser data - cookies - session tokens - payment information - data from cryptocurrency wallets Unlike spyware, which often monitors people’s activity over time, infostealers are designed to steal specific data quickly. Attackers often sell the stolen information or use it to carry out other attacks. These later attacks may involve taking over accounts, stealing identities or spreading ransomware. ### Scareware As the name suggests, scareware uses **fake security warnings** to frighten people into downloading software that supposedly protects their computer from a threat. If someone downloads the software, it often installs additional malware instead of fixing the supposed problem. Scareware can also trick people into revealing sensitive information or installing remote access software. This often happens as part of a tech support scam. ## What are some well-known examples of malware? There are many different types of malware, and you’ve probably heard of some of the programs behind major cyberattacks. Here are a few examples. ### ILOVEYOU ILOVEYOU was one of the early malware attacks that paved the way for many others. In 2000, it spread through malicious email attachments and infected millions of computers. Once activated, the malware made copies of itself, sent itself to more contacts and overwrote numerous files on infected computers. It also stole login credentials and left some systems unusable. The attack caused major email outages worldwide and billions of dollars in economic damage. ILOVEYOU **made more people aware of the dangers posed by malware**. ### Emotet Emotet is a Trojan that was first discovered in 2014. It copies email addresses, sender names and email headers to create messages that look genuine. It often uses existing email conversations to make these messages even more convincing. When someone opens an infected attachment, additional malware is installed. This malware can **shut down systems or steal sensitive information such as banking details**. Emotet often acts as a ‘loader’, meaning it downloads other malware, including ransomware. This allows attackers to compromise entire networks. After several attempts to either shut down or disrupt Emotet, it has appeared less frequently in large-scale attacks since 2023. ### MyDoom MyDoom is a computer worm that spread rapidly in 2004, making it one of the fastest-spreading worms ever. It’s estimated to have caused several billion dollars in damage. Nobody knows exactly where it came from, although its code contains the line ‘andy; i’m just doing my job, nothing personal, sorry’. The worm made copies of itself and spread mainly through email, but it also used peer-to-peer networks. It launched targeted DDoS attacks against the SCO Group and later Microsoft. At its peak, MyDoom is estimated to have reduced internet performance worldwide by around 10%. ### WannaCry WannaCry made headlines around the world in May 2017. The ransomware encrypted files on more than 200,000 computers in over 150 countries. Victims were asked to pay $300 in Bitcoin, with the ransom increasing to $600 after three days. WannaCry used the EternalBlue exploit to take advantage of a Windows security vulnerability and spread automatically through networks. The NHS in the UK was hit particularly hard. Important operations had to be postponed because staff couldn’t access patient records. Major international companies, including Nissan, FedEx and Deutsche Bahn, were also affected. The total damage is estimated at **around $4 billion**. ### Pegasus Pegasus is spyware developed by the Israeli company NSO Group. It’s mainly used to spy on iOS and Android smartphones and can infect a device without the person using it having to do anything. These are known as zero-click attacks. Once installed, Pegasus can access a wide range of information and features on the phone, including messages, the camera, microphone and location data. NSO Group’s customers are mainly governments. According to official statements, they use Pegasus exclusively for **criminal investigations and counterterrorism**. However, Pegasus has faced widespread criticism because it has also been used to spy on journalists, activists and political opponents, as confirmed in several cases. ### BKA Trojan The BKA Trojan is a **combination of scareware and ransomware**. Once it infected a computer, it locked the screen and displayed a full-page warning instead of the usual startup screen. The warning claimed that Germany’s Federal Criminal Police Office (BKA) had found illegal content on the device. People were then told they had to pay to regain access, often through payment services such as Paysafecard. In many cases, the malware didn’t actually encrypt any files. It simply blocked access to the computer. The BKA Trojan first appeared around 2011 and caused serious damage despite using relatively simple technology. This is a markdown version of: [https://www.ionos.com/en-ie/digitalguide/server/security/malware/](https://www.ionos.com/en-ie/digitalguide/server/security/malware/) for AI/LLM consumption.