What Is Malware? Types, Signs and How to Remove It

Malware is the word people reach for when a computer starts doing something it should not, and it is also the word every security product uses to mean everything at once. Both uses are correct, which is exactly why the term feels slippery. Malware is the category, not the attack. A virus is malware. So is ransomware. So is the quiet program reading the passwords saved in your browser and sending them somewhere else. The questions underneath the definition are narrower and more useful: what is actually running on the machine, how did it get there, how would you know, and what gets it off. This page answers those, in that order.

What Is Malware?

The word is a contraction of malicious software, and the two definitions that carry weight agree on its shape. NIST's glossary defines malware as software or firmware intended to perform an unauthorized process that will have an adverse impact on the confidentiality, integrity or availability of a system. The FBI's Internet Crime Complaint Center puts it plainly in its 2025 annual report: software or code intended to damage, disable, or capable of copying itself onto a computer to have a detrimental effect or destroy data.

Two things follow from those definitions that no list of types will tell you.

The first is that malware is defined by authorization, not by behavior. A remote access tool your IT department installed and a remote access tool an attacker installed can be the same program doing the same thing. What makes one of them malware is that nobody agreed to it. This is why "is this file dangerous" is often the wrong question and "did I ask for this" is the right one.

The second is that malware always has a purpose, and there are only five worth knowing:

• Information. Passwords, session cookies, card numbers, crypto wallets, company files. The most common goal by a wide margin.
• Money, directly. Ransomware encrypts your files and sells them back to you. Banking trojans move money out of accounts.
• Your computing resources. Cryptomining uses your processor. Botnets rent your connection out for attacks on other people.
• Access, to sell on. Some malware exists only to open a door and hand the keys to whoever pays for them.
• Damage. Rare outside of state-level conflict, but wipers exist and they do not ask for anything.

The same program is often called a trojan by one vendor and an infostealer by another. One name describes how it arrived, the other what it does.

How Malware Gets on Your Device

Malware has to be run. That is the single most useful fact on this page, because it means there is always a moment where the infection can fail, and most of those moments belong to you rather than to your software.

There are six routes that account for nearly all of it.

1. A message you had every reason to trust. An attachment on an invoice, a link in a delivery notice, a shared document from a colleague's compromised account. This is why a phishing email and a malware infection are so often the same incident described at two different stages.
2. A download that looks like the software you wanted. Search ads and lookalike sites selling the installer for a real, popular application with something extra bundled in. The FBI and CISA have documented threat actors distributing the LummaC2 infostealer inside spoofed or fake versions of popular software, in a joint advisory published in May 2025.
3. A page that asks you to prove you are human. The same advisory documents a fake CAPTCHA that instructs the visitor to copy something to the clipboard and paste it into the Windows Run box, which quietly executes an encoded PowerShell command. The user performs the installation by hand, believing they are passing a bot check.
4. A flaw in software you never touched. No click required. Exploiting a vulnerability is now the way in for 31 percent of all breaches, ahead of stolen credentials for the first time in the report's 19 years, per the 2026 Verizon Data Breach Investigations Report.
5. Something plugged in. A USB drive found in a parking lot is a cliche because it worked, and the FTC still recommends scanning external drives before use.
6. A supplier's legitimate update. Compromise the vendor, and the malware arrives signed and trusted. The same Verizon report puts third-party involvement in 48 percent of breaches, up 60 percent year over year.

Notice that step four is the one modern defenses lean on. Malware that has to phone home is malware that has to generate network traffic, and unusual outbound traffic is far easier for a tool to spot than a new file is.

Types of Malware

Names in this field describe two different things at once: how something arrives, and what it does when it gets there. A single piece of malware is routinely a trojan by delivery, a loader by function and an infostealer by outcome. Read the table as a vocabulary rather than as a set of separate boxes.

Infostealers are the type that matters most to individuals

Infostealers do not slow your machine, encrypt anything or announce themselves. They run once, take everything of value and vanish. The FBI and CISA advisory on LummaC2 lists what "everything of value" means in practice: personally identifiable information, financial credentials, cryptocurrency wallets, browser extensions and multi-factor authentication details, all exfiltrated without immediate detection. Indicators in that advisory span November 2023 to May 2025, so this is not a historical curiosity.

The consequence is delayed. The stolen session cookies and passwords get sold, and the account takeover happens weeks later, by which time nobody connects it to the installer they downloaded in March. This is the strongest argument for changing passwords after any suspected infection rather than only running a scan.

Ransomware is the type that matters most to organizations

Ransomware is malware with a business model attached, and it is now usually two attacks in one: the files are stolen before they are encrypted, so that refusing to pay still leaks the data. The encryption everyone pictures is the last step of an intrusion that started days earlier, and the earlier steps are where it is stoppable.

Trojans and loaders are the delivery system for everything else

A large share of what gets called "a trojan" is really a loader: a small, cheap program whose only job is to establish a foothold and then download whatever the buyer has paid for. That is why one infection often becomes several. Removing the visible piece is not the same as removing the thing that installed it.

Fileless malware is why "scan the drive" is no longer enough

Fileless techniques run inside legitimate system tools, most commonly PowerShell and Windows Management Instrumentation, and leave little or nothing on disk for a signature-based scanner to find. The fake CAPTCHA route described above is exactly this: no file is downloaded, a command is pasted. Detection has to look at behavior rather than at files, which is the whole reason endpoint detection and response tools exist. Fileless malware is one of the twelve cyber security threats that account for most real breaches.

What Is the Difference Between Malware and a Virus?

A virus is one type of malware, in the same way a van is one type of vehicle. The distinguishing feature of a virus is self-replication: it attaches to a file or program and spreads when that host is run. Almost nothing in circulation today does that, because it is a poor design for making money. Modern malware wants to stay on one machine, quietly, for as long as possible.

The word survives because the software that removes malware is still called antivirus. That is a naming accident from the 1990s, not a limitation of the product. A modern antivirus product detects ransomware, infostealers and trojans that are not viruses in any technical sense.

How Do I Know If I Have Malware?

Some malware is loud. The FTC's guidance on recognizing and removing malware lists the classic signs, and they are still worth knowing because they still happen:

• The computer slows down, freezes or crashes.
• The browser home page changes, or you get redirected to sites you did not intend to visit.
• New browser toolbars or add-ons appear that you did not install.
• You get a lot of pop-up ads, including ads on sites that would never carry them.
• You get repeated error messages from the operating system.
• Operating system tools such as Task Manager or Activity Monitor are disabled.
• There are emails you did not write or social media messages you did not post.

Those signs describe adware, scareware and older commodity malware well. They describe an infostealer not at all, and that is the gap worth closing.

Two more that are easy to check and often overlooked. Look at the list of programs that start automatically with your computer, and at your browser's extensions: both are common persistence spots and both are readable in a couple of minutes. And on a phone, look at battery and data usage per app, because a background process that is reporting somewhere shows up there before it shows up anywhere else.

How to Get Rid of Malware

The order matters more than the tool. The FTC's removal sequence puts stopping the damage before cleaning the machine, and that is the right priority: the credentials are usually worth more than the device.

When the scan finds nothing and the symptoms persist, the honest answer is to rebuild. Back up your data files, not applications and not system settings, then reset the operating system from the manufacturer's own recovery process and reinstall software from original sources. It is a few hours against the alternative of trusting a machine you have reason to doubt, and anyone carrying a rootkit or a fileless infection is in that position whether they know it or not.

If passwords, card numbers or a Social Security number were on the device or in the accounts it touched, the follow-up is the same as for any leak, and the sequence is in what to do after a data breach.

How to Prevent Malware Attacks

No single control stops malware, which is the argument for stacking a handful of cheap ones. Each layer below catches a different part of the chain.

Do Macs and Phones Get Malware?

Yes, all of them, and the differences are worth knowing because they change what you should worry about.

Macs get malware, and the volume has grown with the platform's share. The common families are adware, browser hijackers and infostealers distributed through fake installers for popular applications, often through search ads. macOS has real built-in protections, including code signing checks and a malware removal tool, and they do stop a lot. They do not stop a user who has been persuaded to open the file anyway and type their password to authorize it.

iPhones and iPads are the hardest to infect, because apps come from one store and run in strong sandboxes. The realistic risks are different in kind: a configuration profile or mobile device management enrollment that someone talked you into installing, a malicious calendar subscription, and, rarely and expensively, mercenary spyware sold to governments. For almost every reader, an iPhone problem is a phishing problem or a compromised Apple account rather than a virus.

Android allows software from outside the Play Store, which is a genuine feature and also the main infection route. Banking trojans that abuse accessibility permissions are the standard threat: the app asks for permission to observe and control the screen, then uses it to read banking apps and intercept codes. Google Play Protect is on by default and worth leaving on.

The rule across all three: on a phone the attack usually asks for a permission rather than running a file, so read the request, and be suspicious of anything wanting accessibility, device administration or screen recording.

Malware Attacks on Businesses

For a company, malware is where an incident becomes expensive, because one infected laptop is rarely the end of the story. The attacker's next steps are lateral movement and privilege escalation, and the difference between an infected endpoint and a company-wide outage is usually how quickly someone noticed.

The FBI's recommendations for organizations put endpoint detection and response at the center, because those tools see the lateral connections between machines that a per-device scanner cannot. Alongside it: offline, encrypted, immutable backups, no default credentials, least privilege on admin accounts, network segmentation, and prioritized patching of known exploited vulnerabilities on anything facing the internet.