Types of Malware Explained: Viruses, Trojans, Spyware and More

“Malware” gets used as a catch-all for anything bad that happens to a computer. That’s fair, since the word is short for malicious software. But the different types behave very differently. A virus that corrupts files, a trojan hiding in a fake invoice and an infostealer quietly copying saved passwords call for different responses.

Knowing the main types helps you recognize warning signs, understand what your security tools are doing and talk clearly with your IT provider when something looks wrong. This guide covers each common type, how it spreads, what it does and how to protect against it.

What counts as malware

NIST defines malware as software or firmware intended to perform an unauthorized process that will harm the confidentiality, integrity or availability of a system. In plain terms, it’s any program designed to do something to your device or data that you didn’t agree to.

Malware types are often grouped in 2 ways:

• How it spreads: viruses attach to files, worms spread on their own, and trojans trick you into installing them.
• What it does once inside: ransomware encrypts, spyware watches, infostealers take credentials, botnets recruit your device.

Many modern attacks combine several types. A trojan might install an infostealer, which steals a password that later lets an attacker deploy ransomware.

Malware types at a glance

Use this table as a quick reference.

How the main types behave

Viruses and worms: the classics

A virus is code that attaches itself to a legitimate file or program and runs when that file is opened. It needs a person to spread it, for example by sharing an infected file. True file-infecting viruses are less common today than they were, but the word is still used loosely for all malware.

A worm spreads by itself, usually by exploiting a vulnerability in software that’s reachable over a network. That makes worms fast and dangerous. The 2017 WannaCry outbreak combined ransomware with a worm that spread through a Windows file-sharing flaw. According to CISA, Microsoft had released a patch for that flaw in March 2017, before the outbreak began in May. Unpatched systems were the ones hit.

Trojans, RATs and loaders: malware in disguise

A trojan pretends to be something useful, such as a PDF invoice, a software update, a game mod or a free version of a paid app. Once you run it, it does something else entirely.

Common trojan variations include:

• Remote access trojans (RATs) that give an attacker control of your machine.
• Loaders or droppers whose only job is to download more malware later.
• Banking trojans that target online banking sessions.

Trojans rely on trust, so the best defenses are caution about downloads and attachments, and installing software only from official sources.

Ransomware and wipers: malware that hits operations

Ransomware encrypts your files and demands payment for the key. Most modern groups also steal data first and threaten to publish it, so backups alone don’t remove all the risk. It typically gets in through phishing, stolen passwords, exposed remote desktop or unpatched internet-facing devices. Our guide to ransomware protection for small business covers prevention and response in detail.

Wipers look similar but destroy data with no way to recover it, even if a ransom is paid. They’re more common in targeted or state-linked attacks.

Key takeaway: Ransomware is usually the last step of an attack, not the first. Phishing, stolen passwords and unpatched systems are how attackers get in, so blocking those stops most ransomware before it starts.

Spyware, keyloggers and infostealers: malware that watches and steals

Spyware monitors what you do: browsing, messages, location or microphone. On phones, a specific kind called stalkerware is often installed by someone with physical access. See how to tell if your phone is hacked for signs and cleanup steps.

Keyloggers record every keystroke, capturing passwords and messages.

Infostealers have become one of the most damaging types for businesses. They grab saved browser passwords, session cookies and other credentials in seconds, often from a single download of fake or cracked software. Stolen session cookies can let attackers skip MFA by reusing a logged-in session. If an infostealer hits a device, change passwords from a clean device and sign out of all sessions. Our data breach checklist walks through the account steps.

Adware, cryptojackers, rootkits and botnets

• Adware shows unwanted ads and redirects your searches. It’s often more annoying than dangerous, but some adware tracks browsing and opens the door to worse.
• Cryptojackers quietly use your computer or cloud account to mine cryptocurrency. On cloud accounts, the first sign may be a surprise bill.
• Rootkits bury themselves deep in the operating system, sometimes below it, to hide other malware from security tools. They often require a full reinstall to remove.
• Botnet malware enlists devices into a network controlled by an attacker, used for spam, password attacks or flooding websites with traffic. Poorly secured routers, cameras and other connected devices are frequent recruits, which is why changing default passwords matters.

Fileless malware: hiding in plain sight

Fileless malware runs in memory and abuses legitimate built-in tools, such as scripting engines and admin utilities, instead of dropping obvious files. Because there’s little on disk to scan, traditional antivirus may miss it. Endpoint detection and response (EDR) tools that watch behavior, rather than just files, are better at catching it.

How to protect against all types of malware

The same core controls defend against nearly every type on this list.

1. Keep everything updated, including operating systems, browsers, apps, routers and firmware. Turn on automatic updates.
2. Use reputable endpoint protection, ideally with behavior-based detection. Built-in tools such as Microsoft Defender on Windows are a solid baseline.
3. Turn on MFA everywhere, and use a password manager instead of saving passwords in the browser on shared or high-risk devices.
4. Install software only from official sources and avoid cracked or pirated programs.
5. Treat attachments and links with caution, especially unexpected invoices, shipping notices and urgent requests.
6. Limit admin rights so everyday accounts can’t install software or change system settings.
7. Back up with the 3-2-1 rule and keep at least 1 copy offline. Test restores.
8. Change default passwords on routers, cameras and other connected devices.

What to do if you suspect malware

The FTC’s advice for a suspected infection starts with stopping sign-ins to sensitive accounts, then updating and running your security software, then changing passwords and turning on 2-factor authentication. For a business:

1. Disconnect the device from the network, but don’t wipe it yet if you may need to investigate.
2. Tell your IT provider or security contact right away.
3. Change passwords for accounts used on that device, from a different, clean device.
4. Scan and clean, or reinstall the system if the infection is serious or a rootkit is suspected.
5. Check for spread to other devices and accounts.
6. Report serious incidents to the FBI’s IC3 or CISA.

The bottom line

Malware comes in many forms, but most of it gets in the same few ways: phishing, risky downloads, stolen passwords and unpatched software. Learn the types so you recognize the signs, then focus your energy on updates, MFA, careful downloads, limited admin rights and tested backups. For a broader view of how these defenses fit together, start with our guide to what cybersecurity is.

Sources

• NIST CSRC Glossary: Malware — standard definitions of malware and examples
• CISA Alert TA17-132A: Indicators Associated With WannaCry Ransomware — WannaCry spread via SMBv1 exploit, patch release date
• FTC: How to Recognize, Remove, and Avoid Malware — warning signs and removal steps
• FBI IC3: 2025 Internet Crime Report — reporting cybercrime, including ransomware and malware complaints