Types of Malware: A Complete Guide to Viruses, Trojans, Ransomware, Spyware and More

The word malware — short for malicious software — is an umbrella term covering dozens of distinct threat categories. Each type has different objectives, propagation methods, and defensive requirements. Understanding the differences is the first step toward protecting yourself and your organization.

Viruses¶

A computer virus is malware that attaches itself to legitimate programs or files and spreads when the infected file is executed or shared. Like biological viruses, computer viruses require a host — they cannot propagate independently.

Viruses can corrupt files, render systems unbootable, or steal data. Famous examples include the ILOVEYOU worm (2000), which caused an estimated $10 billion in damage, and the CIH (Chernobyl) virus (1998), which overwrote the BIOS of infected machines.

Modern viruses often incorporate polymorphic techniques — changing their own code with each infection to evade signature-based detection.

Worms¶

Unlike viruses, worms are self-replicating and spread across networks without requiring user interaction or a host file. They exploit vulnerabilities in operating systems and network services.

The WannaCry ransomworm (2017) exploited the EternalBlue vulnerability in Windows SMB to spread to over 200,000 systems in 150 countries within days. The Conficker worm (2008) infected up to 15 million systems and created one of the largest botnets ever recorded.

Trojans¶

A Trojan horse (or simply Trojan) disguises itself as legitimate, desirable software. Users willingly install it, not knowing it carries a malicious payload. Trojans do not self-replicate — they rely on social engineering for distribution.

Trojans serve many purposes:
- Banking Trojans (Emotet, TrickBot, Dridex) steal online banking credentials
- RAT Trojans (Remote Access Trojans) give attackers full remote control
- Dropper Trojans download and install additional malware after gaining a foothold
- Backdoor Trojans create persistent access points for attackers

Ransomware¶

Ransomware encrypts the victim's files and demands payment (typically in cryptocurrency) for the decryption key. It has become the most financially damaging malware category.

Modern ransomware operations use a Ransomware-as-a-Service (RaaS) model where developers lease their malware to affiliates in exchange for a percentage of ransom payments. Notable families include LockBit, ALPHV/BlackCat, Cl0p, and REvil.

The average ransom payment reached $1.54 million in 2023. Double extortion — encrypting data and threatening to publish it — is now the norm.

Spyware¶

Spyware collects information about a user or organization without their knowledge. It operates silently in the background, monitoring activity and transmitting data to remote servers.

Keyloggers are a spyware subtype that record every keystroke, capturing passwords, credit card numbers, and private messages. Commercial spyware like Pegasus (NSO Group) targets journalists and activists, exploiting zero-day vulnerabilities to achieve complete device compromise with no user interaction.

Adware¶

Adware displays unwanted advertising, often by hijacking browsers or injecting ads into web traffic. While less dangerous than ransomware, it degrades system performance and can serve as a vector for more serious malware.

Adware frequently arrives bundled with free software — see our guide on PUPs for more detail.

Rootkits¶

A rootkit is a collection of tools that enable unauthorized access to a system while actively hiding its presence from the operating system, antivirus software, and the user. The name refers to Unix "root" (administrator) access.

Rootkits are particularly dangerous because they operate at a level where standard detection tools cannot see them. Kernel-mode rootkits modify the OS kernel itself. Bootkit variants infect the Master Boot Record, loading before the OS and evading most security tools.

The Sony BMG rootkit scandal (2005) involved a music corporation secretly installing rootkits on consumers' PCs through audio CDs.

Botnets¶

A botnet is a network of compromised computers ("bots" or "zombies") controlled by an attacker (the "botmaster") through a command-and-control (C2) server.

Botnets are used for:
- Distributed Denial of Service (DDoS) attacks
- Spam distribution (most spam email comes from botnets)
- Credential stuffing attacks
- Cryptocurrency mining
- Spreading additional malware

The Mirai botnet (2016) compromised IoT devices and launched record-breaking DDoS attacks, temporarily taking down major portions of the internet.

Cryptojackers¶

Cryptojackers (cryptomining malware) use victim's CPU/GPU resources to mine cryptocurrency for the attacker's benefit. The victim experiences system slowdowns, overheating, and higher electricity bills.

Cryptojacking can occur through malicious software or through JavaScript running in a web browser on a compromised website. Coinhive was the most notorious browser-based cryptojacker before shutting down in 2019.

Fileless Malware¶

Fileless malware does not write to disk — it executes entirely in memory, using legitimate system tools like PowerShell, WMI, or the Windows Registry. Since no files are written, traditional signature-based detection largely fails.

Fileless techniques are increasingly used by advanced threat actors. The Astaroth campaign used a chain of legitimate Windows tools to deliver a banking trojan without ever writing a malicious file to disk.

Logic Bombs¶

A logic bomb is malicious code inserted into a legitimate program that executes when specific conditions are met — a particular date, the deletion of a user account, or a specific action. They are often planted by disgruntled insiders.

Keyloggers¶

While a subset of spyware, keyloggers deserve separate mention due to their prevalence. Hardware keyloggers are physical devices plugged between the keyboard and computer. Software keyloggers run as background processes. Both capture every typed character.

Stalkerware¶

Stalkerware is a category of spyware marketed for relationship surveillance — monitoring a partner's location, messages, and calls. It is frequently installed by abusive partners without the victim's consent. Many major antivirus vendors now detect and flag stalkerware.

FAQ¶

What is the most dangerous type of malware?
Ransomware currently causes the greatest financial damage globally. However, sophisticated APT (Advanced Persistent Threat) malware targeting critical infrastructure may pose greater long-term risks.

Can malware infect an iPhone?
iOS is more resistant due to its sandboxed architecture, but not immune. Zero-click exploits (like those used by Pegasus) can compromise iPhones without any user interaction.

What's the difference between malware and a virus?
All viruses are malware, but not all malware is a virus. "Virus" refers to a specific self-replicating type. "Malware" is the broader category including ransomware, trojans, spyware, and everything else.

How do I know if I have malware?
Common signs: system slowdown, unexpected pop-ups, changed browser settings, programs launching without your input, unexplained network activity, or files that have been encrypted.

Does Mac need antivirus?
Yes. macOS has built-in protections (XProtect, Gatekeeper) but faces a growing malware threat. Adware, fake antivirus, and cryptocurrency stealers frequently target Mac users.

This article is published by ScamSandbox to help users understand and avoid malware threats and online scams.