Malware and cyber defence, explained
Types of malware, compared
The main types of malware are viruses, worms, trojans, ransomware, spyware, adware, rootkits, keyloggers, bots and wipers. They differ in two ways: how they spread (by themselves, inside other files, or by tricking you) and what they do once they are in. The table below compares all ten.
The 10 types of malware, compared
Each row is one type: how it gets around, what it does, the first thing a defender would notice, and a real example. The "defender would notice" column is the part most lists leave out, and it is how security teams actually find these.
| Type | How it spreads | What it does | What a defender notices | Example |
|---|---|---|---|---|
| Virus | Attaches to a program or document and spreads when that file is shared and opened | Corrupts or deletes files, or carries another payload | Program files whose contents (and hash) have changed | Brain (1986), CIH (1998) |
| Worm | Copies itself across networks on its own, through unpatched flaws or weak passwords | Spreads, then delivers a payload | A spike in connections to one port from many machines | Morris worm (1988), SQL Slammer (2003) |
| Trojan | Disguised as something wanted: a free app, a crack, an invoice | Opens a backdoor, steals data, installs more malware | A newly downloaded program making unexpected outbound connections | Zeus banking trojan (2007), Emotet (2014) |
| Ransomware | Usually installed by attackers already inside, or by a trojan | Encrypts files and demands payment; often steals data first | Hundreds of files rewritten in seconds; backup copies deleted | WannaCry (2017), LockBit |
| Spyware | Bundled apps, malicious links, or exploits on phones | Records messages, location, calls and passwords | Unexpected uploads; apps with accessibility or admin rights they do not need | Pegasus |
| Adware | Bundled with free software and browser extensions | Floods you with ads, changes your search engine | New extensions and a changed homepage or search engine | Fireball (2017) |
| Rootkit | Installed by other malware that already has admin rights | Hides files, processes and itself from the operating system | What the system reports differs from what is on the disk | Sony BMG copy-protection rootkit (2005) |
| Keylogger | Usually part of a trojan or spyware | Records every key pressed, including passwords | A process hooking keyboard input | Agent Tesla |
| Bot (botnet) | Worm-like spread, or default passwords on devices | Joins a network of hijacked devices that attack, spam or mine on command | Regular check-ins (beacons) to the same server | Mirai (2016) |
| Wiper | Placed by attackers inside a network, sometimes disguised as ransomware | Destroys data with no way to get it back | Disk structures and files overwritten in bulk | Shamoon (2012), NotPetya (2017) |
Sorted by how they spread
The quickest way to tell malware types apart is to ask what moves it from one device to the next.
- It moves itself: worms and bots. Patching and closing exposed services stops them.
- A file carries it: viruses. Scanning files and not opening unexpected attachments stops them.
- You install it: trojans, adware and most spyware. Installing only from official sources stops most of them.
- An attacker places it: ransomware, rootkits and wipers are usually deployed by a person who is already inside the network. Detecting that person early (the job of EDR) is the defence.
The first three are explained with a step-by-step demo in virus vs worm vs trojan.
Other names you will hear
- Remote access trojan (RAT) or backdoor: a trojan whose job is to let an attacker control the device remotely.
- Infostealer: malware that grabs saved passwords, browser cookies and crypto wallets in one sweep and sends them off. Stolen cookies can let an attacker into accounts without the password or the second factor.
- Fileless malware: malware that runs in memory using tools already on the system, such as PowerShell, so there is little or no file for antivirus to scan.
- Cryptojacker: malware that mines cryptocurrency with your processor.
- Loader or dropper: small malware whose only job is to download and install the real payload.
- Scareware: fake warnings that your device is infected, to sell you a useless or malicious "fix".
Which types matter most today
For organisations, ransomware and the data theft that now comes with it cause the most damage. For people, infostealers, banking trojans and phishing that leads to them cause the most losses. Classic viruses that infect files are now rare. How ransomware works walks through a modern attack stage by stage, and the famous malware attacks timeline shows how the mix has changed since 1986.
Questions people ask
What is the most common type of malware?
Trojans, in the broad sense of malware that arrives disguised as something legitimate, are the most common way malware reaches people. Ransomware causes the most damage to organisations. The exact ranking changes year to year and depends on who is counting.
What is the most dangerous type of malware?
For organisations, ransomware, because it combines data theft with encryption and can stop a business for weeks. For individuals, banking trojans and spyware, because they steal money and accounts quietly.
Can one piece of malware be several types at once?
Yes, and most modern malware is. WannaCry was ransomware that spread like a worm. Emotet started as a banking trojan and became a delivery service that installed other malware. The types describe behaviours, not boxes.