Malware is software or other code intentionally designed to perform unauthorised, harmful, deceptive or unwanted actions on a computer system, device, network or data environment. The word is a contraction of “malicious software” and functions as an umbrella term rather than describing one specific program type. Malware includes viruses, worms, Trojan horses, ransomware, spyware, some forms of adware and rootkits, although classification boundaries can overlap. A program can contain multiple capabilities, meaning that one malware family might steal information, establish persistence, download additional components and provide remote access. The defining characteristic is malicious or unauthorised purpose rather than a particular programming language, file format or delivery mechanism.
Malware can achieve different objectives through mechanisms such as execution, persistence, privilege escalation, defence evasion, command and control, data collection, credential theft, encryption, destruction or unauthorised modification. Some malware operates primarily on the local device, while other malware communicates with attacker-controlled infrastructure. Modern malware may use modular architectures in which an initial loader installs additional components only after determining that the environment is suitable. This approach can reduce the size of the initial payload and allow attackers to change capabilities without distributing an entirely new program. Malware may also abuse legitimate operating-system functionality to reduce the amount of obviously malicious code present on a compromised system.
Malware can be delivered through malicious email attachments, links, compromised websites, software downloads, removable media, exploited vulnerabilities, malicious advertisements, supply-chain compromises or already-compromised systems. The delivery mechanism is distinct from the malware itself. For example, phishing may be the social-engineering method used to persuade a user to execute a malicious program, while the resulting program could be a Trojan or ransomware component. Similarly, vulnerability exploitation may install malware without requiring a user to open an attachment. This distinction is important during incident analysis because defenders need to understand both how the malware arrived and what it subsequently did.
Historically, malware often consisted of relatively self-contained programs designed to demonstrate technical capabilities, cause disruption or spread between computers. As internet connectivity expanded, malware became increasingly associated with organised criminal activity, botnets, credential theft, fraud and remote access. Contemporary malware development can involve professionalised criminal ecosystems in which different actors specialise in initial access, malware development, infrastructure, laundering proceeds or ransomware operations. Malware can also be adapted rapidly in response to defensive controls, with attackers changing file characteristics, communication infrastructure, execution methods and obfuscation techniques to make detection more difficult.
Malware detection traditionally relied heavily on signatures that identify known malicious files or patterns. Modern endpoint security supplements signatures with behavioural analysis, reputation systems, sandboxing, memory inspection, anomaly detection and telemetry from processes, files, registry activity, network connections and authentication events. Attackers can attempt to evade these controls through obfuscation, packing, encryption, process injection, living-off-the-land techniques and delayed execution. No detection mechanism is perfect, particularly against previously unseen malware or carefully tailored attacks. Effective defence therefore combines prevention, monitoring, containment and response rather than relying exclusively on antivirus signatures.
Malware analysis can be static or dynamic. Static analysis examines a sample without executing it and may involve file structure, strings, imported functions, embedded resources, cryptographic hashes and disassembly. Dynamic analysis executes the sample in a controlled environment to observe processes, file changes, network communications, persistence mechanisms and other behaviours. Reverse engineering may be required for sophisticated samples, while memory analysis can reveal information that is absent from the malware's original file. Analysts may also compare samples to known malware families using behavioural and code-level characteristics. These techniques support incident response, detection engineering and threat intelligence.
A significant misconception is that malware necessarily produces obvious symptoms. Some malware is designed to remain quiet, steal information gradually or operate only when specific conditions occur. Malware may also use legitimate system processes, making malicious activity difficult to distinguish from normal administration. Another misconception is that deleting a visible malicious file always removes the infection. Persistent malware may create scheduled tasks, services, startup mechanisms, modified accounts or other components that restore access. Remediation therefore often requires identifying the complete infection chain, removing persistence and validating the integrity of affected systems rather than simply deleting one detected file.
Protecting systems from Malware involves reducing both the probability of execution and the consequences of compromise. Application control, secure software sources, patch management, endpoint protection, least privilege, email filtering, browser security and user awareness can reduce common infection paths. Network segmentation and restrictive outbound communication can limit malware after execution, while reliable offline or otherwise protected backups can support recovery from destructive malware. Incident-response procedures should preserve relevant evidence and identify affected systems before widespread remediation. Because malware encompasses many distinct families and behaviours, security controls should be designed around attack techniques and system exposure rather than assuming that every malware sample behaves like a traditional computer virus.
