The Field Guide to Malware: 12 Digital Threats Explained
“Virus” is the word everyone uses — but it’s only one creature in a much bigger zoo. Here’s a plain-English guide to the main types of malware, how each one behaves, and how to keep it off your devices.
First, what is malware?
Malware — short for malicious software — is any program built to harm you, your device, or your data, or to do something you never agreed to. Think of it as a germ for computers: instead of a fever, it might steal your passwords, lock your files, spy on you, or quietly hand control of your machine to someone else.
A virus is just one kind of malware. People use the two words as if they mean the same thing, but that’s like calling every animal a “dog.” Below are the twelve types worth knowing — and the single trait that sets each one apart is simple: how it spreads, and what it wants.
The 12 types of malware
Each “case file” shows what the threat is, how it works, where you’ve seen it, and what to watch for. The bar shows a rough sense of how dangerous it typically is.
- What it is
- Malicious code that hides inside a legitimate file or program and activates when you open it.
- How it spreads
- Only when an infected file is shared and then run by a person — it can’t travel on its own.
- In the wild
- A booby-trapped macro inside a Word or Excel document.
- What it is
- Like a virus, but it copies itself across networks automatically — no human needed.
- How it spreads
- Exploits security holes to jump from machine to machine on its own.
- In the wild
- WannaCry, which spread worldwide through the SMB/EternalBlue flaw.
- What it is
- Harmful software hidden inside something that looks safe and useful.
- How it spreads
- You install it yourself, believing it’s a game, tool, or document.
- In the wild
- A “free” cracked app that quietly opens a backdoor.
- What it is
- Locks your files with encryption and demands payment to unlock them.
- How it spreads
- Phishing attachments, or a worm that spreads it across a network.
- In the wild
- WannaCry renamed files to .WNCRY and demanded Bitcoin.
- What it is
- Secretly monitors your activity and steals information.
- How it spreads
- Bundled with other downloads, then runs hidden in the background.
- In the wild
- Software tracking your browsing habits and saved logins.
- What it is
- Floods you with unwanted ads and often tracks your browsing.
- How it spreads
- Rides along with free software; injects pop-ups and redirects.
- In the wild
- A browser toolbar you never meant to install.
- What it is
- Buries itself deep in the system to stay hidden and keep control.
- How it spreads
- Often dropped by other malware, then cloaks its activity.
- In the wild
- Kernel-level code that hides malicious processes from tools.
- What it is
- Records every keystroke to capture passwords and messages.
- How it spreads
- Delivered by a trojan or spyware, then logs input silently.
- In the wild
- Capturing your banking login exactly as you type it.
- What it is
- Turns your device into a remote-controlled “zombie.”
- How it spreads
- Many infected devices obey one attacker’s commands at once.
- In the wild
- A botnet flooding a website in a DDoS attack.
- What it is
- A hidden way in that bypasses normal login and security.
- How it spreads
- Planted by a trojan, letting an attacker return anytime.
- In the wild
- A reverse-shell payload that quietly calls home to a hacker.
- What it is
- Runs in memory using trusted tools, leaving little on disk.
- How it spreads
- Abuses legitimate programs like PowerShell to avoid detection.
- In the wild
- A malicious script that never saves a file to analyze.
- What it is
- Fake warnings that scare you into buying or installing junk.
- How it spreads
- Pop-ups claiming your PC is infected, urging you to “act now.”
- In the wild
- “Your PC has 5 viruses! Click here to clean it.”
Quick comparison
The fastest way to tell these apart: does it spread by itself, and what is it after?
| Type | Spreads by itself? | Main goal | Threat level |
|---|---|---|---|
| Virus | No | Infect & damage files | Medium |
| Worm | Yes | Spread fast & wide | High |
| Trojan | No | Sneak in disguised | High |
| Ransomware | Sometimes | Extort money | Critical |
| Spyware | No | Steal information | Medium |
| Adware | No | Push ads / track | Low |
| Rootkit | No | Stay hidden & in control | High |
| Keylogger | No | Capture keystrokes | High |
| Bot / Botnet | Sometimes | Remote-control your device | High |
| Backdoor | No | Keep secret access | High |
| Fileless | No | Run invisibly in memory | High |
| Scareware | No | Trick you into paying | Low |
How to protect yourself
The good news: a handful of habits stop the vast majority of these threats.
Patches close the security holes that worms and exploits rely on. Turn on automatic updates.
Don’t open unexpected attachments or links. Most infections start with a single click.
Keep real-time protection on. It catches known threats and blocks suspicious connections.
Keep offline or cloud backups. If ransomware strikes, you restore instead of paying.
Even if a keylogger steals your password, MFA can stop attackers from getting in.
Avoid pirated and “cracked” software — it’s a favorite hiding spot for trojans.
Frequently asked questions
Is a virus the same as malware?
No. Malware is the umbrella term for all malicious software; a virus is just one type of malware. Worms, trojans, ransomware, and spyware are all malware too — but they behave differently.
What’s the difference between a virus and a worm?
A virus needs you to open an infected file to spread. A worm spreads by itself across a network with no human action. That self-spreading ability is what makes worms so dangerous.
Which type of malware is the most dangerous?
It depends on the goal, but ransomware and worms often cause the most damage — ransomware because it can shut an organization down, and worms because they spread automatically. WannaCry combined both.
Can phones get malware?
Yes. Phones can be hit by spyware, trojans, adware, and more — usually through malicious apps or links. Stick to official app stores and keep your phone updated.
How do I know if I’m infected?
Common signs include sudden slowdowns, pop-ups, unfamiliar apps, a changed browser homepage, or your device running hot while idle. Run a trusted antivirus scan if you notice these.
The bottom line
Every one of these threats is really answering two questions: how does it get in, and what does it want? Once you can spot those two things, the confusing list of names becomes a simple map. Keep your software patched, stay skeptical of unexpected clicks, back up your data, and you’ve already shut the door on most of them.
