What Is Malware? Types, Examples, and Detection

Malware, short for "malicious software," is any program or code built to infiltrate systems, steal data, disrupt operations, or take unauthorized control of a digital environment such as a computer, server, or network. The category covers everything from a self-replicating worm to a script that never writes a file to disk.

Delivery has shifted toward channels that defenders watch far less closely. CloudSEK's investigation into an APT36 campaign documented phishing archives carrying Linux desktop entry files disguised as PDFs. Opening one pulled a hex-encoded dropper from Google Drive, decoded it into a temporary directory, established persistence, and opened a WebSocket channel to attacker infrastructure.

No exploit was featured anywhere in the chain described above. A trusted cloud service carried the payload, a shortcut file carried the execution, and reputation-based filtering flagged nothing.

How Malware Works: The Infection Lifecycle

Campaigns differ in payload and target, and the sequence stays remarkably consistent. Each phase exists to make the next one possible.

Initial access. Entry through a phishing message, a malicious download, an exposed service, or an exploited vulnerability. Social engineering accounts for the majority.
Execution and privilege escalation. Code runs, establishes a foothold, and reaches for higher permissions. Security controls are disabled or bypassed where possible.
Lateral movement. Network-aware malware scans for reachable systems and expands using stolen credentials, shared drives, and trusted internal connections.
Payload activation. The objective executes: files encrypted, credentials harvested, data staged and exfiltrated, or resources hijacked.
Persistence and evasion. Registry changes, scheduled tasks, startup modifications, or memory-resident techniques keep access alive while obfuscation hides the activity.

Removal is where most teams stop too early. Persistence established in phase five turns a contained infection into an open incident. Removing the payload leaves the persistence mechanism running, and the attack path reopens the moment anyone considers the case closed.

How Does Malware Get Onto a System?

Here are the main causes for malware spread.

Phishing and social engineering: malicious attachments, links to hosted payloads, and spear phishing messages crafted from real correspondence. This remains the highest-volume route by a wide margin.
Trusted cloud and collaboration platforms: payloads hosted on Google Drive, SharePoint, or Dropbox inherit the platform's reputation. The APT36 campaign above worked on exactly this basis.
Exploited vulnerabilities: unpatched internet-facing services give attackers direct execution with no user involvement at all.
Compromised software updates: a poisoned update from a trusted vendor reaches every customer at once and bypasses every perimeter control by design.
Malvertising and drive-by downloads: compromised ad networks and injected scripts deliver payloads to visitors of otherwise legitimate sites.
Removable media: USB devices still cross network boundaries that nothing else crosses, which is how Stuxnet reached air-gapped systems.
Stolen credentials: valid logins let an operator install whatever they want without triggering a single delivery control.
Unsafe downloads: Installing free apps, cracked software, or fake updates from untrusted websites.

Types of Malware

Classification by name produces a long list that explains very little. Grouping by function shows why one control catches some families and misses others entirely.

Malware That Spreads on Its Own

These families propagate without further attacker involvement, which turns containment into a race against the spread.

Virus: attaches to a legitimate executable and activates only when that file runs. Spread requires users to share or execute the infected file.
Worm: self-replicates and spreads across networks independently by exploiting vulnerabilities, needing no user interaction at any point. WannaCry and NotPetya both used this behavior.
Botnet malware: infects internet-connected devices and links them into a single, remotely controlled network directed by an attacker, used for distributed denial-of-service, spam distribution, and credential stuffing at scale.

Malware That Relies on Deception

Nothing in this group spreads without help from the target. A person has to be persuaded to run it, so delivery quality matters more than code quality.

Trojan: disguised as legitimate software to trick users into installing it. Frequently acts as a loader, delivering a second and more capable payload after installation.
Scareware: uses fear and fake security alerts to trick users into downloading harmful programs or paying for useless software.
Adware: injects intrusive advertising, and the more aggressive variants track behavior and resell the resulting profile.

Malware Built to Extract Value

This group produces the payloads that end up in an incident report. Ransomware draws the most attention, and credential theft accounts for far more compromises.

Ransomware: encrypts files or locks systems and demands payment for recovery. Ransomware-as-a-service operations lowered the skill required to run a campaign.
Spyware: secretly installs on your device to monitor browsing, communications, and credentials covertly, exfiltrating data over an extended period. It sends all the data to third parties without your consent.
Keylogger: records keystrokes to capture passwords, payment details, and anything typed into a session.
Infostealer: harvests saved browser credentials, session cookies, and cryptocurrency wallet data in a single pass, then exits. Stolen session cookies bypass multi-factor authentication entirely.
Cryptojacker: hijacks processor and graphics resources to mine cryptocurrency without permission, showing up as unexplained resource consumption rather than data loss.

Malware Built to Stay Hidden

Concealment drives the design of every technique in this group, and each one defeats a different control.

Rootkit: modifies system-level processes to conceal files, processes, and network connections from the tools meant to enumerate them. It gives an attacker high-level administrator or "root" access to a computer.
Backdoor: bypasses authentication to provide persistent remote access, surviving password resets and the patching of the original entry point.
Fileless malware: runs in memory using built-in administration tools such as PowerShell and WMI, leaving no executable for a scanner to examine.
Polymorphic malware: rewrites its own code on each infection, which makes yesterday's signature useless against today's sample.
Metamorphic malware: completely rewrites its own code and internal structure with every single iteration to avoid detection.
Logic bomb: stays dormant until a specific date, action, or condition triggers the payload, which defeats sandbox analysis on first execution.

Malware vs Virus: What Is the Difference?

Virus describes a subcategory, not a synonym for the whole field. Every virus is malware, and most malware encountered today is not a virus, because self-replicating file infectors stopped being the dominant form years ago.

Factor	Malware	Virus
Definition	Any software built to harm, exploit, or disrupt systems	A malware type that attaches itself to legitimate files
Scope	Umbrella category covering every malicious program type	One narrow subcategory within that umbrella
User Interaction	Required for some types, unnecessary for others	Requires execution of the infected file to spread
Propagation	Networks, exploits, phishing, supply chains, stolen credentials	Spreads when infected files are shared or run
Objective	Theft, encryption, surveillance, sabotage, resource hijacking	Replication and file infection
Detection Approach	Behavioral analysis, memory inspection, threat intelligence	Signature matching works reasonably well

Real-World Malware Attack Examples

These campaigns still define how the categories above behave at scale.

WannaCry, 2017

Worm-style propagation using the EternalBlue exploit reached more than 200,000 computers across 150 countries within days, with damage estimates between four and eight billion dollars. A researcher's discovery of a kill-switch domain slowed it. US and UK authorities later attributed it to the North Korea-linked Lazarus Group.

NotPetya, 2017

Attackers compromised the update server of Ukrainian accounting software M.E.Doc, then spread worm-style through enterprise networks. It presented a ransom demand while functioning as a destructive wiper with no recovery path. Damage exceeded ten billion dollars, making it the costliest cyberattack on record.

Stuxnet, discovered in 2010

Multiple zero-day exploits and infected USB drives carried it across air-gapped systems into Iranian nuclear facilities. It damaged roughly 1,000 centrifuges while feeding operators falsified monitoring data that showed normal operation.

Emotet, 2014 to 2022

A banking trojan that became a modular loader rented to multiple criminal groups. Its thread-hijacking technique inserted replies into genuine email conversations, which defeated the usual phishing recognition cues. International law enforcement disrupted it in 2021, and it resurfaced briefly before declining.

APT36 Desktop Entry Campaign, 2025

The campaign described at the top of this page shows the current pattern rather than the historic one. A state-aligned group used a legitimate cloud service for payload hosting and a Linux shortcut file for execution, targeting government systems on a platform most defenders treat as low risk.

How Big Is the Malware Problem?

Volume and effectiveness point in different directions, which is the single most useful thing to understand about the current landscape. The AV-TEST Institute registers over 450,000 new malware and unwanted application samples every day, against a total catalogue that has passed 1.56 billion samples.

That number describes attacker output and says nothing about attacker success. Mandiant's M-Trends 2026 analysis found exploitation of vulnerabilities was the most common initial infection vector for the sixth consecutive year, accounting for 32 percent of intrusions where the vector could be established.

CloudSEK's own casework shows the other end of that spectrum. The FortiBleed campaign assembled a database of validated device credentials for internet-facing gateways through reuse, brute force, and offline hash cracking, with no malware involved at any stage. Signature scanning has nothing to catch in an intrusion built that way.

Both of those realities hold at the same time without any contradiction. Sample volume keeps climbing while a growing share of serious intrusions never drop a file, so identity and behavioral telemetry now carry as much weight as endpoint scanning.

How to Detect Malware

Detection rests on deviation from an established baseline, not on an antivirus alert. These signals produce most confirmed findings.

Performance and resource anomalies: sustained processor load, memory consumption, or thermal behavior with no matching workload. Cryptojacking and active encryption both present this way.
Unexplained outbound connections: traffic to unfamiliar destinations, on uncommon ports, or at regular intervals no business process explains. This is the clearest command-and-control indicator.
Configuration drift: security settings changed, privileges modified, unfamiliar startup entries, or new scheduled tasks created outside a change window.
Process lineage anomalies: an office application spawning a scripting host, or a web server process launching a shell. Fileless techniques surface here and nowhere else.
Account behavior irregularities: logins from unrecognized locations, altered account details, and session activity that does not match the user's pattern.
Correlated low-signal events: one odd startup entry, one rare outbound connection, and one unusual login hour mean little apart. A security operations workflow that joins them produces a confirmed finding.

Why Detection Fails in Practice

Missed infections trace back to a small set of recurring obstacles, and better signatures solve none of them.

Fileless execution: living-off-the-land techniques use signed system binaries. No malicious file ever touches disk, so file scanning has no target.
Polymorphism: code that rewrites itself per infection defeats hash and signature matching by design.
Trusted-platform delivery: payloads hosted on Google Drive, SharePoint, or Dropbox inherit the reputation of the platform. The APT36 case above works precisely because of this.
Encrypted command-and-control: control traffic hides inside TLS alongside everything else, which leaves basic network monitoring with metadata and timing only.

How to Prevent Malware Infections

Prevention works in layers, and each layer closes a delivery path the others leave open.

Email and Delivery Controls

Advanced filtering, attachment detonation, and link rewriting intercept the majority of delivery attempts before they reach an inbox. Treat files arriving through trusted cloud platforms as a separate detection category, since reputation filtering passes them. Social engineering training raises the report rate, which matters more than the click rate.

Identity and Access Controls

Multi-factor authentication, role-based access, and privileged access management limit what a successful infection reaches. Zero trust conditions remove the implicit internal trust that lateral movement relies on, and monitoring for leaked credentials catches the access route that involves no malware at all.

Endpoint and Network Controls

Endpoint detection and response supplies behavioral analysis and containment that signature scanning cannot. Application allowlisting blocks unauthorized execution outright. Network segmentation limits blast radius, and traffic analysis with encrypted-traffic visibility exposes control channels.

Patching and Attack Surface Reduction

Exploitation leads the initial-access figures, which puts patch velocity on internet-facing systems ahead of most other controls. External attack surface management finds the exposed services that never made it into an inventory.

Supply Chain and Vendor Controls

NotPetya arrived through a routine software update from a trusted vendor. Supply chain attacks bypass every perimeter control because the delivery mechanism is trusted by design, so vendor risk monitoring and dependency verification belong in the same program as endpoint protection.

Backup and Recovery

Offline or immutable backups decide whether a ransomware incident is a recovery exercise or a negotiation. Validate restore integrity on a schedule, because a backup taken after infection restores the malware alongside the data.

Tracking Malware Campaigns Before Delivery

The APT36 campaign was documented while it was running, not after a victim reported an infection. That is the practical difference threat intelligence makes: the C2 domain, the Google Drive hosting pattern, and the desktop-entry technique were all published as indicators before most targets had seen the phishing email. CloudSEK Threat Intelligence tracks threat actors, malware campaigns, and exploited vulnerabilities, and turns that activity into intelligence scoped to an organization's industry and region.

Malware FAQs

Is all malware a virus?

No. A virus describes one malware type that attaches to legitimate files. Most malware encountered today spreads through other mechanisms entirely.

Does antivirus stop every type of malware?

No. Signature detection handles known families. Fileless, polymorphic, and living-off-the-land techniques need behavioral analysis and endpoint telemetry.

Can malware run without writing a file to disk?

Yes. Fileless malware executes in memory through built-in administration tools, which leaves no artifact for file-based scanning to find.

How does malware get past email filtering?

Through trusted platforms and shortcuts. Payloads hosted on legitimate cloud storage inherit its reputation, and archive files hide the real extension.

Which malware type causes the most damage?

Wipers, measured per incident. They present as ransomware while offering no recovery path, which made NotPetya the costliest attack on record.

Does removing malware end the incident?

No. Credentials accessible during the infection remain compromised, and competent operators leave a second persistence mechanism behind.

How long does malware stay undetected?

Weeks to months, depending on telemetry quality. Espionage-focused intrusions sit at the long end because remaining hidden is the objective.