Malware types explained
Viruses, worms, trojans, spyware, infostealers, adware, rootkits and botnets. What each one does, how it spreads and the warning signs on your own devices.
Malware in one sentence
Malware (malicious software) is any program written to harm you, spy on you or use your device without permission. The labels below describe how a piece of malware spreads or what it does, and a single modern sample often fits several of them at once.
The main families
| Type | How it spreads | What it does |
|---|---|---|
| Virus | Attaches to files or programs; spreads when they are shared and opened | Corrupts or deletes data, or carries another payload |
| Worm | Spreads by itself across networks, using unpatched flaws | Can infect thousands of machines in hours |
| Trojan | Disguised as something useful: a free tool, game cheat, cracked app | Opens a back door for the attacker |
| Spyware | Bundled apps, malicious links, or someone with physical access | Records activity, location, messages |
| Infostealer | Fake downloads, malicious ads, pirated software | Grabs saved passwords, browser cookies, crypto wallets |
| Keylogger | Usually part of a trojan or spyware | Records everything you type |
| Ransomware | Phishing, stolen remote-access logins | Encrypts or steals files for extortion, see ransomware |
| Adware | Free software bundles, browser extensions | Floods you with ads, redirects searches |
| Rootkit | Installed by other malware with admin rights | Hides malware deep inside the system |
| Botnet agent | Worms, weak passwords on smart devices | Joins your device to a remote-controlled network used for spam or attacks |
| Cryptojacker | Malicious sites, infected servers | Uses your processor to mine cryptocurrency |
Infostealers: the quiet threat of the 2020s
Infostealers deserve special attention. They do not lock your screen or demand money. They run for a few seconds, copy every password saved in your browser plus your session cookies, and send them to the attacker. Session cookies can let a criminal open your accounts without needing your password or your two-factor code. Stolen logs are sold in bulk on criminal markets and are a common starting point for account takeovers and company breaches.
The usual infection route is a download you chose yourself: a "free" version of paid software, a game mod, a fake browser update or a search ad pointing to a look-alike site.
Warning signs
- Your device suddenly becomes slow, hot or noisy when idle.
- New toolbars, extensions or a changed search engine you did not choose.
- Pop-ups on websites that never used to show them, or system notifications from unknown sites.
- Friends receive messages from you that you did not send.
- Password-reset emails you did not request, or logins from unfamiliar places.
- Security software has been turned off and will not turn back on.
None of these prove infection, but several together are worth acting on.
How to stay clean
- Keep everything updated. Most worms and many exploits use flaws that already have fixes. See software updates.
- Install software only from official sources: the vendor's website, the Microsoft Store, the App Store or Google Play.
- Never run cracked software, keygens or game cheats. They are the single biggest source of infostealers.
- Keep built-in protection on: Microsoft Defender on Windows, XProtect on Mac, Google Play Protect on Android. See built-in antivirus.
- Use a password manager instead of saving passwords in the browser on shared or high-risk computers, and use passkeys where available.
- Do not use an administrator account for everyday work on Windows.
If you think you are infected
Disconnect from the internet, run a full scan with your built-in antivirus, and consider a second-opinion scanner. Then, from a different, clean device, change your important passwords and sign out of all sessions for email, banking and social media, because stolen cookies keep working until you do. If the problem keeps coming back, back up your personal files and reset the device to factory settings.