Definition
Malware (short for “malicious software”) is software intentionally designed to damage, disrupt, or gain unauthorized access to a system. It’s best understood as an umbrella category defined by intent and behavior, not by one specific delivery method or technique. Ransomware, rootkits, and cryptojacking tools covered elsewhere on this site are all, technically, malware. This page is the general foundation those more specific pages build on, and it deliberately doesn’t repeat their individual mechanics.
Three classic behavioral categories are worth knowing by name, because the terms show up constantly and mean genuinely different things: a virus needs a host program to attach to and spread when that program runs; a worm spreads on its own across a network without needing a human to run anything; a trojan disguises itself as legitimate, wanted software to convince a user to install it voluntarily.
What Makes It Work
Malware exploits the assumption that a file, attachment, download, or piece of installed software will actually do what it appears to do. Most operating systems and users operate on a basic, mostly necessary trust: if something looks like a PDF, a system update, or a familiar application, it’s treated as safe enough to open or run. Malware breaks that assumption by disguising harmful code as something ordinary enough not to trigger suspicion.
What security property breaks depends entirely on the specific payload: a piece of malware might break confidentiality (stealing data), integrity (modifying files or logic), availability (see ransomware), or some combination of all three. That’s precisely why “malware” alone is a category, not a severity level or a specific threat description.
Where It Actually Shows Up
- Malicious email attachments and links remain among the most common delivery vectors, relying on the same trust-in-the-sender dynamic covered on the Phishing page.
- Compromised or malicious downloads, including software cracks, fake browser updates, and malicious ads on otherwise legitimate sites (see Drive-by Download).
- Exploited software vulnerabilities, where malware is delivered as the payload of a separate technical exploit rather than requiring any user action at all.
- Removable media (USB drives), a lower-volume but still real vector, especially in environments with air-gapped or restricted-network systems where it can be one of the few ways in.
Why It Keeps Succeeding
Signature-based detection (checking a file against a database of known-malicious patterns) will always lag behind newly modified or freshly packed malware variants that don’t match any signature yet. Attackers routinely take existing, well-understood malware and lightly modify it specifically to evade signature matching, without needing genuinely novel capability. Compounding this, users are trained by ordinary daily use to trust familiar file types and sender names, which is precisely the trust malware delivery is built to exploit.
How to Detect It
Behavioral and endpoint detection, watching for what a process actually does (unexpected network connections, unusual file system activity, attempts to disable security tooling), catches malware that signature-based scanning misses entirely. The important mental model to carry into any conversation about this: the absence of an antivirus alert is not the same thing as the absence of malware. It’s the absence of a known pattern, which is a meaningfully weaker claim.
Impact by Scenario
| Scenario | Realistic impact |
|---|---|
| Malware isolated to a single endpoint with no further network or credential access | Contained to that device: real but bounded impact |
| Malware on a machine with broad network access or cached credentials | The infected endpoint becomes a pivot point into much more of the environment |
| Malware achieving long-term persistence without detection | Extended, compounding exposure: the longer it runs undetected, the more it can do |
| Malware whose payload specifically targets backup or security infrastructure | Removes the organization’s own ability to detect or recover from what follows |
Why a Business Should Care
Malware is the delivery mechanism behind a large share of the most damaging, specific incident types covered elsewhere on this site: ransomware, cryptojacking, and credential theft all typically start with a malware infection of some kind. That means investment in endpoint detection, application allow-listing, and least-privilege account design has compounding value: it doesn’t just prevent “a virus,” it raises the bar against every more specific, more damaging outcome that starts the same way. This is a genuinely useful way to justify baseline endpoint security spend to a client who sees it as a generic line item: it’s foundational to nearly everything else on the attack-types list.
A Worked Example
(Fully invented for illustration; no real organization, incident, or data referenced.)
An employee at Verdant Analytics downloads what appears to be a legitimate productivity plugin from a search result, not realizing the download page is a convincing clone hosting a trojanized installer. The malware executes silently alongside the real plugin, and because the employee’s account has standing access to a shared network drive used across three departments, the malware’s built-in credential-harvesting module immediately has far more reach than the single laptop it started on. IT discovers the infection two weeks later, when unusual outbound network traffic from that shared drive’s file server, unrelated to the original laptop, triggers an alert.
Severity Calibration
This scenario rates High rather than Critical specifically because, although the malware’s reach extended well beyond the initial device via the shared drive, no successful account takeover or data exfiltration to an external destination was confirmed by the time it was detected: the demonstrated impact was reach, not yet proven data loss. A confirmed identical infection with proof of successful external data exfiltration would rate higher. As always, the malware category alone doesn’t set severity: what it actually reached and did is what matters.
Prevention & Response
The real fix is layered and behavioral, not purely signature-based: endpoint detection and response (EDR) tooling that watches behavior rather than only matching known patterns, application allow-listing so only approved software can run at all, least-privilege account design so one compromised endpoint can’t reach everything, and prompt patching to close the exploitable vulnerabilities malware often rides in on.
The common inadequate fix is relying on signature-based antivirus alone and treating a clean scan as proof of a clean system: exactly the gap this page’s “How to Detect It” section addresses directly.
Related Attacks & Vulnerabilities
- Ransomware: the extortion-specific subtype with its own dedicated page.
- Rootkit: malware specifically engineered to hide its own presence.
- Cryptojacking: malware that steals compute resources rather than data.
- Drive-by Download: one of the most common delivery vectors covered above, in its own full depth.