Trojan Horses are malicious programs that masquerade as legitimate, useful, desirable or otherwise harmless software or content in order to persuade a user or system to execute or install them. The name derives from the classical Trojan Horse story and refers to deceptive presentation rather than self-replication. A Trojan may appear to be a legitimate application, document, installer, browser extension, update or utility while secretly performing unauthorised actions. Unlike a virus or worm, deception is the defining characteristic of a Trojan, not autonomous replication. Trojans can deliver additional malware, establish remote access, steal credentials, modify systems, monitor activity or perform other malicious functions once execution has occurred.
Trojan Horses are commonly distributed through phishing messages, malicious websites, fake software downloads, unofficial application repositories, cracked software, deceptive advertisements, fraudulent updates and compromised legitimate websites. Social engineering is often important because the attacker wants the victim to trust the apparent purpose of the program or file. A fake browser update might persuade a user to execute an installer, while a counterfeit utility could claim to improve system performance while secretly installing malicious components. The initial Trojan may be comparatively simple because its principal task is to obtain execution and establish access, after which additional payloads can be retrieved from attacker-controlled infrastructure.
Trojan functionality varies substantially. Remote-access Trojans can provide attackers with interactive control of compromised systems, while banking Trojans may target financial credentials or transaction information. Downloader or dropper Trojans can install additional malware, credential-stealing Trojans can capture authentication material, and information-stealing Trojans can collect browser data, cookies or files. Some Trojans function as backdoors that provide persistent unauthorised access. These labels describe common functional roles rather than a universally fixed taxonomy, and one Trojan family can possess several capabilities simultaneously.
The distinction between a Trojan and other malware categories is particularly important because the same malicious program can incorporate multiple techniques. A Trojan may deliver ransomware, spyware or a rootkit, but its Trojan characteristic concerns the deceptive means by which the software is presented or obtained. A virus infects hosts to replicate, while a worm propagates autonomously across systems. A Trojan does not need either behaviour. This means that calling a ransomware payload a Trojan may be appropriate when it was delivered through a deceptive program, but “ransomware” describes the payload's extortion function whereas “Trojan” describes its deceptive delivery or execution model.
Trojan Horses exploit trust, which makes technical security controls only part of the defence problem. Users may be more likely to execute software that appears to come from a familiar company or that promises an urgent security or productivity benefit. Attackers can imitate branding, use realistic filenames, purchase advertising placement or compromise legitimate distribution channels. Code signing does not automatically establish that software is benign because legitimate certificates can be abused or malicious software can be distributed through compromised legitimate mechanisms. Software provenance, application allow-listing, secure download practices and behavioural endpoint controls therefore complement user awareness.
Detection can involve examining executable reputation, digital signatures, process behaviour, parent-child process relationships, network communications, persistence mechanisms and interactions with sensitive information. A Trojan may attempt to hide its activity through packing, obfuscation or execution within legitimate processes. Security products may quarantine known samples, but previously unseen variants can require behavioural detection or analysis. Sandboxing can reveal suspicious activity by executing a sample in an isolated environment, although sophisticated malware may attempt to detect analysis environments and alter its behaviour accordingly.
A common misconception is that every Trojan is visibly disguised as an application. Deception can occur at many levels, including a malicious document presented as an invoice, a fake update notification, a fraudulent browser extension or a compromised software package. Another misconception is that installing antivirus software makes Trojans impossible to execute. Endpoint protection can significantly reduce risk but cannot guarantee detection of every malicious or newly created sample. Least privilege is particularly valuable because limiting user and application privileges can reduce the damage a successfully executed Trojan can perform.
Reducing Trojan risk requires attention to both software supply and human decision-making. Organisations can restrict installation privileges, use managed software repositories, enforce application control, filter suspicious email, monitor unusual execution chains and prevent unnecessary scripting or macro execution. Users should obtain software from trustworthy sources and be cautious of unsolicited installers or urgent update prompts. When a Trojan is discovered, responders should determine whether it established persistence, downloaded further payloads, stole credentials or created unauthorised access. Removing the visible program without investigating secondary components can leave the underlying compromise intact.
