Malware and cyber defence, explained
What is malware?
Malware, short for malicious software, is any program or code made to harm a computer, phone or network, steal data, or take control of a device without its owner's permission. Viruses, worms, trojans, ransomware and spyware are all kinds of malware.
What does malware do?
Malware does whatever earns its author money or advantage, and most of it falls into six jobs.
- Steal: passwords, bank details, session cookies, company files.
- Extort: ransomware encrypts files, or threatens to publish stolen data, until a ransom is paid.
- Spy: spyware and keyloggers record what you type, say and look at.
- Hijack: bots join your device to a botnet that sends spam, attacks websites or mines cryptocurrency on your electricity.
- Open a door: backdoors and remote access trojans let an attacker in later, whenever they like.
- Destroy: wipers erase data for good, usually for sabotage rather than money.
One infection often does several of these. Modern ransomware gangs steal data first, then encrypt it, so they can demand payment twice. Types of malware, compared puts each kind side by side.
How does malware get onto a device?
Almost all malware arrives in one of five ways, and each has a known defence.
| Way in | What it looks like | What stops it |
|---|---|---|
| Phishing | An email or text with a link or attachment that looks routine: an invoice, a parcel, a password reset. | Checking the real domain of links, attachment filtering |
| Unpatched software | A flaw in a server, browser or app that lets code run without anyone clicking. | Installing updates quickly |
| Stolen passwords | Logging in to remote access, email or a VPN with a password leaked elsewhere. | Multi-factor authentication, unique passwords |
| Fake downloads | Pirated software, "free" versions of paid apps, fake browser updates. | Installing only from official stores and sites |
| Trusted updates | Malware slipped into a real vendor's update (a supply-chain attack). | Monitoring what software does after it is installed |
Phishing is the most common first step for attacks on people, which is why it has its own guide: how to spot a phishing link.
The four stages of an infection
Security teams think about malware as a chain of steps, because breaking any single link stops the attack.
This is why defence comes in layers. An email filter might miss a message, but the antivirus can still block the attachment; if that fails too, a backup still means ransomware cannot hold your files hostage.
Signs a device may have malware
Most malware is built to stay hidden, so the signs are indirect and each can have an innocent cause.
- Your antivirus or firewall has been switched off and you did not do it.
- Friends receive messages or emails from your accounts that you never sent.
- New browser extensions, toolbars or a changed search engine appear.
- Pop-ups appear even when no browser is open.
- The device is suddenly slow, hot or draining battery while idle.
- Files have new extensions and will not open, and a ransom note appears (this one is not subtle).
If you see these, run a full scan with your security software, change important passwords from a different device, and turn on multi-factor authentication.
How is malware stopped?
Malware is stopped by layers: each one catches some of what the layer before it missed.
- Updates close the flaws worms and exploits need.
- Multi-factor authentication makes stolen passwords far less useful.
- Security software recognises known malware and suspicious behaviour. How antivirus detects malware explains the five methods it uses.
- Backups kept offline turn ransomware from a disaster into an inconvenience (the 3-2-1 backup rule).
- People who can spot a lure, which is the layer no software replaces.
Questions people ask
Is a virus the same thing as malware?
No. A virus is one kind of malware: one that spreads by attaching itself to other files. Malware is the umbrella term that also covers worms, trojans, ransomware, spyware and the rest. People often say "virus" when they mean malware in general.
Can phones get malware?
Yes. Android phones mostly get it from apps installed outside the Play Store or from malicious apps that slip into it. iPhones are infected far less often, usually by targeted spyware that exploits unpatched flaws. On both, installing updates promptly is the best protection.
Does malware go away on its own?
No. Most malware is built to survive restarts and to hide. Removing it takes security software, restoring from a clean backup, or for a serious infection, wiping the device and reinstalling.
Is it legal to learn how malware works?
Yes. Learning how malware works is how defenders are trained, and it is the subject of university courses and certifications. What is illegal in most countries is using or spreading malware against systems you do not have permission to access.