Malware
noun · also Malicious software · NIST CSRC Glossary
Any software designed to harm a system or its users, such as viruses, worms, trojans, ransomware, spyware and infostealers.
Malware is the umbrella term for malicious software. The categories describe how it spreads or what it does, and a single sample often fits several:
- Virus: attaches to legitimate files and spreads when they run.
- Worm: spreads on its own across networks, without user action.
- Trojan: pretends to be useful software to get installed.
- Ransomware: encrypts data and demands payment.
- Infostealer: harvests saved passwords, cookies and crypto wallets from a device.
- Remote access trojan (RAT) and backdoor: give the attacker ongoing control.
Modern attacks often use small "loaders" or "droppers" whose only job is to download the next stage, which makes the first file look harmless.
Example
A user downloads a cracked version of a paid application. It works, but it also installs an infostealer that uploads the browser's saved passwords and session cookies to the attacker. A week later, those cookies are used to sign in to the user's corporate accounts without a password or MFA prompt.
Why it matters for a SOC analyst
When an alert names a malware family, look it up: knowing whether it is a stealer, a loader or ransomware tells you what to check next and how urgent it is. Do not stop at "the file was quarantined". Find out how it arrived, whether it ran before it was blocked, and what it could have taken. For infostealers, that means resetting credentials and revoking sessions, not just cleaning the device.
Related terms
- Trojan
Malware disguised as legitimate software, such as a cracked app, a fake update or an invoice, that the victim installs themselves.
- Worm
Malware that copies itself from system to system on its own, usually by exploiting a vulnerability, without any user action.
- Rootkit
Malware that hides itself and other malicious activity by modifying the operating system, often at the kernel or boot level.
- Fileless malware
Malicious code that runs in memory or through legitimate tools like PowerShell, leaving few or no malicious files on disk to scan.
- Ransomware
Malware that encrypts an organization's data and demands payment for the key, often after stealing the data to threaten its release.
- EDR
Security software on laptops and servers that records process, file and network activity, detects malicious behavior and lets analysts respond.
- Indicator of compromise
An observable artifact, such as a file hash, IP address, domain or registry key, that suggests a system may have been compromised.