Types of Malware Explained With Examples

Malware is any software, firmware or hardware put into a system on purpose to cause harm. The main types differ in how they spread, what they hide behind and what they do once they are in.

This guide explains the common types with plain definitions from NIST and CISA, examples where I could verify them, and the habits that protect you. Sources were checked on October 22, 2026.

The short answer

The main kinds are viruses, worms, trojans, ransomware, spyware, rootkits, botnets and logic bombs. Viruses and worms spread, trojans disguise themselves as something useful, ransomware demands money, and spyware and rootkits spy and conceal.

Malware can arrive through attachments, deceptive downloads or links, infected drives and unpatched software flaws. Keep software updated, run anti-malware tools and keep a backup.

What malware means

NIST describes malware as hardware, firmware or software deliberately put into a system to cause harm. Its glossary treats malicious code as a synonym.

The word is short for malicious software. It covers everything from an annoying program to a tool that locks a hospital's files.

Malware types list

This table is a quick map. The definitions follow NIST's glossary, and CISA's for ransomware. The impact column is our summary.

Type	What it does	Typical impact
Virus	Spreads by modifying other programs to carry a copy of itself, and runs when the infected program runs	Altered or damaged programs and files
Worm	Spreads on its own through systems or networks, and often uses up resources	Fast spread and strained resources
Trojan horse	Looks useful but hides a harmful function	Unwanted access or extra malware
Ransomware	Encrypts files and demands payment to restore them	Locked data and disrupted services
Spyware	Is secretly installed to gather information without your knowledge	Lost privacy and stolen information
Rootkit	Conceals an attacker's activity and keeps hidden access	Hard to detect and remove
Botnet	Joins infected computers into a network a criminal controls remotely	Your device is used to attack others
Logic bomb	Waits for set conditions, then runs a harmful function	Delayed disruption or damage

Viruses and worms

NIST describes a virus as malware that spreads by changing other programs to include a copy of itself, which runs when the infected program is used. It needs a host program to travel.

A worm is a self-contained program that spreads through computers or networks by itself. NIST adds that worms are frequently built to consume resources like storage or processing time.

Trojan horses

NIST describes a trojan as a program that looks useful while also carrying a hidden function that may be malicious. The name refers to the ancient story of the wooden horse.

Berkeley's security office lists baiting as a related trick. One example from City College of San Francisco's security guide is a website offering free music or movie downloads that are infected.

Ransomware

According to CISA, ransomware is malware that keeps evolving and is built to encrypt files on a device, so the files and the systems relying on them cannot be used. Attackers then demand a ransom for decryption.

CISA adds that ransomware actors often threaten to sell or leak data they have stolen if the ransom is not paid. So backups help with locked files, but not with leaked ones.

Spyware

NIST describes spyware as software installed on the quiet to collect information about people or organizations without their knowledge, and calls it a type of malicious code.

A high-end example is commercial spyware aimed at individual phones. Our guide to government surveillance and spyware covers what Apple calls mercenary spyware.

Rootkits

NIST describes a rootkit as a set of tools used after an attacker gains root-level access to a host, to conceal their activity and hold on to that access covertly.

Because hiding is the point, a rootkit may give you no obvious sign. That is why prevention, updates and trusted security tools matter more than spotting symptoms.

Botnets

NIST's glossary, quoting a security vendor, says the word botnet comes from robot and network. Criminals use trojans to take control of many computers and organize them into a network they manage remotely.

A real example is the Aisuru-Kimwolf botnet, which Cloudflare linked to a record 31.4 terabit-per-second attack.

Cloudflare attributes the attack to the botnet as a whole, not to one type of malware. Our guide to what a botnet is explains how they work.

Logic bombs

NIST defines a logic bomb as code intentionally inserted into software that sets off a malicious function when specified conditions are met, such as a date.

I did not find a verified public example to cite here, so I give none. The point is that the harm waits, which makes insiders and supply chains the usual worry.

Malware types diagram

A diagram helps if you group by behavior. This table is our grouping, not an official taxonomy.

Behavior	Types
Spreads	Virus, worm
Disguises itself	Trojan horse
Demands payment	Ransomware
Spies and hides	Spyware, rootkit
Takes remote control	Botnet
Waits for a trigger	Logic bomb

The table is a simplification. Real malware often belongs to several groups at once.

What malware can do to you

The effect depends on the type. CISA says ransomware can make files, and the systems that rely on them, unusable. NIST says spyware collects information without you knowing.

A botnet can use your device to attack others, and CISA notes the infected devices are victims too. A rootkit can help hide other malware on the same device.

Real-world examples

WannaCry is ransomware. According to CISA's alert, its operators got into servers through a critical Windows SMB vulnerability that Microsoft had patched on March 14, 2017.

BlackMatter is a ransomware-as-a-service tool. CISA says it first appeared in July 2021 and lets its developers profit from affiliates who deploy it. CISA calls it a possible rebrand of DarkSide.

Aisuru-Kimwolf is a botnet, and Cloudflare attributes a record 31.4 terabit-per-second attack to it. The botnet is the network of devices, and the attack is one thing it was used for.

How malware gets in

CISA says an email attachment is a common delivery mechanism for malware, and that attackers may use a false sense of urgency to get you to open it without checking.

A US health department cybersecurity newsletter adds that a link in a phishing message may download malicious software, and that attachments can run malicious code when opened. Our phishing guide covers how to spot these messages.

Not all malware needs you to open something. The WannaCry example above relied on an unpatched flaw, which is why updates matter.

How to protect yourself

The same newsletter advises keeping anti-malware software and system patches up to date, because updates close the flaws malware exploits. It also says to keep a current backup, in case ransomware locks your data.

CISA's guidance on denial-of-service attacks advises installing and maintaining antivirus software and a firewall. This is our advice, built on those sources.

If you think you have malware

This is our advice, in order.

Type	First step
Ransomware	Disconnect the device and contact your IT team. CISA has a page for people hit by ransomware
Spyware	Run a trusted scan from a clean device and change your passwords
Trojan or virus	Scan, remove and check what else was installed
Botnet	Update or replace the device and change its passwords

The first steps are our advice, not an official procedure. Where your organization has an incident process, follow it.

At home and at work

At home, the main defenses are updates, care with links and backups. At work, add managed security tools, limits on who can access what and a fast way to report incidents.

More types of malware

The main families are covered above. These are other types that readers often ask about. Definitions here are common usage.

A destructive example

CISA's alert on NotPetya describes a strain of malware that, if it gained administrator rights, encrypted the master boot record and made infected Windows computers unusable. It says NotPetya differed from earlier Petya malware primarily in how it spread.

The point of the example is that damage, not money, was the effect. Backups that you have tested are the defense that matters, and our ransomware guide explains how to test them.

How malware gets onto a device

Most infections need a person to take an action, or a flaw that has not been patched.

The common routes are attachments, links, fake software updates, pirated programs, infected USB drives and unpatched software. Keeping software updated closes the last route, and caution closes the others.

Signs of malware

Some malware hides well, but many infections cause signs. These are possible clues, not proof.

• A device that is slow, hot or noisy when you are not using it.
• New toolbars, home pages or search engines that you did not choose.
• Programs you do not recognize, or security tools that switched themselves off.
• Pop-ups outside the browser, or ads where none used to be.
• Your contacts receive messages that you did not send.

Look at what is running

On a Linux computer, you can list the busiest processes with one command, and check network connections with another. These commands only read information, so they are safe to try.

ps aux --sort=-%cpu | head
ss -tn

The first command sorts running programs by processor use, which reveals a cryptojacker that is working hard. The second shows open network connections.

Look for names you do not recognize, then search for them before you take any action. On Windows, the Task Manager shows similar information.

Phones are not immune

Malware exists for phones too, though the route is different. It usually arrives through apps from unofficial sources, malicious links in text messages and risky permissions that you grant.

Install apps only from the official store, keep the system updated and review permissions. Our Android permission guides cover how.

If you think you are infected

Disconnect from the network, run a scan with trusted security software and change your passwords from a clean device.

If the device holds important data and the scan finds something serious, consider restoring from a known good backup or resetting it.

Frequently asked questions

Which types of malware are the main ones?

The main kinds are viruses, worms, trojans, ransomware, spyware, rootkits, botnets and logic bombs. Many real programs mix several of these.

How does a virus differ from a worm?

A virus needs a host program and spreads by modifying it. A worm spreads on its own across systems or networks.

What are examples of malware?

WannaCry and BlackMatter are ransomware examples documented by CISA, and Aisuru-Kimwolf is a botnet documented by Cloudflare.

Is ransomware a type of malware?

Yes. CISA calls it a form of malware designed to encrypt files and demand a ransom.

Is there a Hindi version?

Not in this guide. Use the English definitions above.

What is fileless malware?

Malicious code that runs in memory or uses built-in tools, leaving few files for antivirus to find.

What is a keylogger?

A program that records what you type so an attacker can read passwords and messages.

How can I tell if my computer has malware?

Look for unexplained slowness, unfamiliar programs, changed browser settings and security tools that turned off.

A quick checklist

• Keep operating systems and apps updated.
• Be careful with attachments and links.
• Run anti-malware software.
• Keep a current offline backup.
• Report anything odd to your IT team.

Up nextWhat is a botnet and how it worksOne malware type deserves its own guide. Read what a botnet is and how it works.→