What Is Malware? Types, How It Spreads, and How to Stay Safe

When Verizon’s researchers studied the victims of ransomware attacks for their 2026 report, they found something that rarely makes the headlines: roughly three out of four of those victims had already had an infostealer infection or a credential leak in the year before the attack. The ransom note was the loud part. The malware that opened the door was quiet, and it had been there for a while.

Most people hear the word malware and picture a virus that crashes a computer. Real malware is usually the opposite. It is built to stay unnoticed, because the longer it stays, the more it can take. This guide explains what malware is, the main types and what each one actually does, how it gets onto devices, why antivirus alone does not settle the question, and the habits that reduce your risk the most. No technical background required.

1. What malware actually is

Malware is short for malicious software: any program built to do something harmful to a device, the data on it, or the person using it. NIST, the US standards body, defines it in one of its glossary entries as “software or firmware intended to perform an unauthorized process that will have adverse impact on the confidentiality, integrity, or availability of an information system.” Another NIST definition describes it as a program inserted into a system, usually covertly, to compromise the victim’s data, applications, or operating system.

The important word in both definitions is covertly. Malware is not defined by how it looks or how it spreads. It is defined by intent: software that does something its owner never agreed to. A program can be tiny or enormous, written by a teenager or a criminal company, and still be malware if its purpose is to harm, spy, steal, or take control.

It also helps to know what malware is not. A software bug is an accident. A phishing email is a message, not a program, although it is often how malware arrives. And an ordinary app that collects too much of your data is a privacy problem, not necessarily malware. The line is that malware is designed from the start to work against you.

2. The main types, by what they do

The names for malware can feel like a zoo of animals and insects. It is easier to remember them by their job. Some types are named for how they spread, others for what they do once they are in. Many real attacks combine several.

Viruses and worms. These are defined by how they spread. A virus attaches itself to a legitimate program or file and needs a person to run that file to activate. A worm is more self-sufficient: it copies itself from machine to machine across a network, often without anyone clicking anything. That independence is why worms can move so fast.

Trojans. Named for the wooden horse, a trojan pretends to be something you want: a free tool, a cracked game, a document viewer. Once you run it, it does something else. Trojans are one of the most common ways people end up infected, because the victim installs them willingly.

Spyware and infostealers. Spyware watches what you do and reports it. An infostealer is a more targeted form that goes straight for the valuables: saved passwords, browser data, payment details, and the login sessions your browser keeps. We come back to why these matter so much below.

Ransomware. This locks your files or systems and demands payment to restore them. It is the most disruptive type and has its own deep dive: our guide on what ransomware is and what to do if you are hit covers it in full.

Rootkits and botnets. A rootkit hides other malware deep in a system so it is hard to find or remove. A botnet is a network of infected devices that an attacker controls remotely, often to send spam or flood a website with traffic. Your device can be part of a botnet and work normally enough that you never notice.

3. The assumption that gets people infected

The belief most of us carry is that you would know if you were infected. Malware, in this picture, announces itself: the computer slows to a crawl, pop-ups appear, files disappear. And so, the thinking goes, if nothing seems wrong, nothing is wrong.

Old malware wanted attention. Modern malware wants the opposite. A device that runs perfectly while it quietly hands over your passwords is the goal, not a failure of the attack.

That belief belongs to an earlier era, when a lot of malware was vandalism. Today the money is in theft and access, and both depend on staying hidden. An infostealer that crashes your laptop is a bad infostealer. This is why the absence of symptoms tells you very little, and why habits that prevent infection matter more than the ability to spot it.

A second belief causes its own trouble: that certain devices are immune. Malware is written for whatever people use, and attackers go where the value is. No mainstream operating system is immune, and the safest assumption is that any device connected to the internet can be a target.

4. How malware gets onto a device

There are only a handful of routes, and they repeat. Knowing them tells you where your attention is best spent.

Software you install yourself. This is the trojan route. Pirated software, “free” versions of paid tools, fake browser extensions, and lookalike download pages all rely on you choosing to run something. Search results and ads can lead to convincing fakes, so the source of a download matters as much as the file.

Attachments and links. A document or archive arrives in an email or message, and opening it, or enabling something inside it, runs the malware. These messages often borrow urgency or a familiar name, which is why this overlaps with social engineering. The message is the bait; the malware is the hook.

Unpatched software. Attackers do not always need you to do anything. If a program or device has a known flaw that has not been fixed, malware can use it to get in. In Verizon’s 2026 report, exploiting a vulnerability was the most common way breaches began, at 31%, and it overtook stolen credentials as the top route for the first time. CISA puts the principle simply: many software updates exist to fix security risks, and skipping them leaves devices unprotected.

Stolen or weak logins. Not all intrusions involve a file at all. An attacker with a valid password can log in and install what they want. Our article on how passwords actually get stolen explains how this starts, and the next section explains how malware feeds it.

Removable and shared media. A USB drive picked up or borrowed can carry malware. It is a smaller route than it once was, but it still appears, especially in workplaces.

5. Why infostealers matter most right now

If you remember one type from this guide, make it the infostealer. It is cheap, common, and often the first link in a much bigger attack.

An infostealer runs on a device, finds what the browser and system have stored, and sends it to the attacker. That can include saved passwords, autofill details, and the session tokens that keep you logged in to your accounts. SpyCloud, which tracks stolen data, reported recapturing about 13.2 million infostealer infections in 2025, averaging around 50 credentials each. That figure is theirs, not Verizon’s, and it counts only what they were able to recover.

The stolen material is then sold or traded. In Verizon’s 2026 data, 73% of ransomware victims had an infostealer infection or credential leak in the year before they were hit, and half of those leaks happened within 95 days of the attack. The pattern is easy to see: infostealer first, bought access second, ransomware third. Different criminals handle different steps.

There is a subtler problem too. Because infostealers can copy login sessions, they can sometimes let an attacker into an account without ever needing the password or the second-factor code. The software company CircleCI described exactly this in its own incident report. An engineer’s laptop was compromised in December 2022, and the attacker took what the company called a valid, 2FA-backed single sign-on session. Access was not shut down until January 4, 2023, which was 19 days after the first infection.

Why this changes the mathA strong password protects you from guessing. It does not protect you from malware that reads the password straight out of your browser. The device you log in from is part of your security.

6. Signs your device may be infected

Since good malware hides, signs are clues, not proof. Several together deserve attention. A device that is suddenly much slower, hotter, or draining its battery without reason can be running something in the background. Browser settings that change on their own, such as a new home page, unfamiliar extensions, or constant redirects, point to unwanted software. Security tools that turn themselves off, programs you do not remember installing, and accounts showing logins you did not make are all worth checking.

The reverse is the important part: no symptoms does not mean no infection. This is why the most valuable security habits happen before anything goes wrong.

7. What to do if you think you are infected

Order matters here, and the most common mistake is to start with the device and forget the accounts.

Disconnect first. Take the device off the internet by turning off Wi-Fi or unplugging the cable. This can stop data leaving and stop the malware talking to its operator.

Use a different, clean device to secure your accounts. Change passwords for your email, banking, and other important accounts from a device you trust, not the infected one. Do your email first, because it can reset everything else. Where an account offers it, use the option to sign out of all devices, since a changed password alone may not end a session an attacker already holds.

Scan and clean, or reset. Run a full scan with your device’s security tools. For serious or persistent infections, the most reliable fix is to back up only the files you need, reset the device to a clean state, and reinstall. This is also the right call if you cannot be sure what the malware did.

Check for damage. Watch bank and card statements, and look at the recent activity or login history on important accounts. If this is a work device, tell your IT or security team immediately instead of trying to handle it alone. Our guide to what actually happens during a security incident shows what the response looks like from the inside.

8. What actually reduces your risk

No single tool stops all malware, and that includes antivirus. Security software is a useful safety net, and you should keep the protection built into your device switched on. But it works best on threats it already knows about, and attackers actively test their malware against it. Think of it as one layer, not the whole defense. A few habits do far more.

Keep everything updated. This is the highest-value habit for most people. Turn on automatic updates for your operating system, browser, and apps, and install updates promptly, especially for the browser. If a device or program no longer receives updates, replace it.

Install software only from sources you trust. Use official app stores or the publisher’s own site, and type the address yourself or use a bookmark instead of clicking a search ad. Avoid cracked software entirely. It is one of the most reliable ways to get infected.

Treat attachments and links as untrusted by default. Be most careful when a message creates urgency, comes from an unexpected sender, or asks you to enable macros or run something. If it claims to be from someone you know, confirm through a separate channel before opening it.

Use a password manager and turn on multi-factor authentication. Unique passwords limit the damage when one is stolen, and a second factor makes a stolen password alone far less useful. It does not solve everything, as the session-theft case showed, but it removes a large part of the problem.

Do not run as an administrator for daily use. Using a standard account limits what malware can change if it does run. This applies to personal devices as well as workplaces.

Keep backups, and keep one offline. Backups do not stop malware, but they let you recover without paying anyone. A copy that is not permanently connected to your device cannot be locked or deleted along with it.

On a network, limit how far an infection can travel. For businesses, separating systems and restricting access means one infected device does not expose everything. A firewall helps control traffic, but it is one piece of the picture.

9. Frequently asked questions

What is malware in simple terms?

Malware is software designed to harm, spy on, steal from, or take control of a device or its owner. The name is short for malicious software, and it covers viruses, trojans, spyware, infostealers, and ransomware, among others.

What is the difference between a virus and malware?

Malware is the broad category. A virus is one specific type, which attaches to a legitimate file or program and spreads when that file is run. Every virus is malware, but most malware is not a virus.

How does malware get onto a device?

Common routes are software you install yourself, such as pirated or fake downloads, malicious email attachments and links, unpatched software with known flaws, stolen logins, and infected removable media. Many infections involve more than one of these.

Can malware be on my device without me knowing?

Yes. Much modern malware is designed to be invisible, because staying hidden lets it keep stealing data. A device that seems to run normally can still be infected, which is why prevention matters more than detection.

Is antivirus enough to protect me from malware?

It helps but is not enough on its own. Security software is best at catching known threats, and attackers test against it. Regular updates, careful downloads, strong unique passwords, multi-factor authentication, and backups give much broader protection.