Overview
Malware is software intentionally designed to harm a system, steal information, disrupt services, or give an attacker unauthorized access. Recognizing the category a piece of malware falls into (rather than just its name) is what actually helps in detection work later.
Key concepts
- Self-replicating: virus, worm
- Disguise & extortion: trojan, ransomware
- Surveillance: spyware, keylogger, adware
- Stealth & control: rootkit, bot, botnet
How it works
Self-replicating malware
These spread on their own, but differ in how.
| Type | How it spreads |
|---|---|
| Virus | Attaches to a legitimate file or program and spreads when that file is opened or run. The most common form of infection. |
| Worm | Copies itself and spreads across networks on its own, without needing a host file — generally more complex to write than a virus. |
Disguise & extortion
| Type | What it does |
|---|---|
| Trojan | Appears to be legitimate software but performs harmful actions once installed. |
| Ransomware | Encrypts files or locks a system, then demands payment to restore access. |
Surveillance malware
These focus on quietly collecting information rather than causing visible damage.
| Type | What it collects |
|---|---|
| Spyware | Secretly collects information about a user or device. |
| Keylogger | Records keystrokes specifically to steal passwords and other sensitive input. |
| Adware | Displays unwanted ads and may also track user activity. |
Stealth & remote control
These are about an attacker maintaining hidden, long-term access.
| Type | What it does |
|---|---|
| Rootkit | Hides itself within a system and gives an attacker privileged access. |
| Bot | A single infected device that can be remotely controlled by an attacker. |
| Botnet | A group of bots controlled together, often used for large-scale attacks like DDoS. |