Cybercriminals are no longer interested in causing random computer crashes. Today, malware has become a profitable business. Organized cybercrime groups develop sophisticated malicious software to steal money, spy on individuals, disrupt businesses, and demand multimillion-dollar ransoms. Some attacks are so advanced that victims may not realize they have been compromised for weeks or even months. This chapter explores seven of the most dangerous malware categories.
1. Ransomware
Ransomware encrypts files on a victim's computer or network, making them inaccessible until a ransom is paid to the attackers, often in cryptocurrency because it is harder to trace. The victim opens a malicious attachment or visits a compromised website, the ransomware installs silently, scans for documents, photos, databases, backups and network drives, encrypts files with strong cryptography, and displays a ransom note demanding payment for a decryption key. Some modern ransomware also steals data before encryption and threatens to publish it — a tactic known as double extortion.
Common infection methods include phishing emails, malicious downloads, exploiting software vulnerabilities, Remote Desktop Protocol (RDP) attacks, compromised websites, and infected USB devices. Warning signs include files suddenly becoming inaccessible, changed file extensions, a ransom note on screen, high disk activity, and unusual network traffic. The WannaCry outbreak in 2017 affected more than 200,000 computers across over 150 countries, disrupting hospitals, businesses, and government agencies.
Prevention: maintain regular offline backups, apply security updates promptly, disable unnecessary remote access services, use endpoint detection and response (EDR), train employees to recognize phishing, and enable multi-factor authentication.
2. Spyware
Spyware secretly monitors user activity and collects sensitive information without consent, while remaining hidden. It can collect usernames and passwords, banking credentials, browsing history, emails, screenshots, location data, contact lists, and financial information. Types include password stealers, banking spyware, browser hijackers, surveillance spyware, and information stealers. Symptoms include slow performance, unexpected advertisements, browser redirects, increased network activity, and unknown installed software. Prevention: download software only from trusted sources, keep browsers and operating systems updated, use reputable anti-malware software, and review app permissions on mobile devices.
3. Adware
Adware automatically displays advertisements. While some ad-supported software is legitimate, malicious adware overwhelms users with intrusive ads, redirects browsers, changes settings, tracks browsing habits, and downloads additional unwanted software. Risks include reduced performance, privacy concerns, exposure to malicious websites, and higher likelihood of malware infections. Prevention: avoid unknown browser extensions, choose custom installation options to decline bundled software, review installed programs regularly, and use browser security features and reputable ad blockers.
4. Rootkits
A rootkit is an advanced malware designed to hide itself and other malicious software from users and security tools. It operates at a deep system level, hides files, processes and registry entries, disables security software, maintains long-term persistence, and enables remote control by attackers. Because they conceal their presence, rootkits allow attackers to remain inside systems for extended periods. Detection is challenging and typically relies on specialized anti-rootkit tools, behavioral monitoring, and offline system analysis. Prevention: enable Secure Boot where supported, install software only from trusted sources, keep firmware and operating systems updated, and use advanced endpoint security.
5. Keyloggers
A keylogger records every keystroke typed on a keyboard and sends the captured information to attackers — login credentials, online banking details, credit card numbers, personal messages, business documents, and authentication codes. Types include software, hardware, kernel-level, and browser-based keyloggers. Warning signs include unexpected slowdowns, unknown background processes, suspicious outbound network traffic, and unauthorized account activity. Prevention: enable multi-factor authentication, use password managers, keep antivirus updated, and avoid untrusted downloads.
6. Botnets
A botnet is a network of compromised devices controlled remotely by cybercriminals. Each infected device — often called a bot or zombie — follows commands from a command-and-control (C2) server without the owner's knowledge. Commonly targeted devices include PCs, servers, IoT devices, smart cameras, home routers, and smartphones. Botnets are used for Distributed Denial-of-Service (DDoS) attacks, sending spam, cryptocurrency mining, credential theft, malware distribution, and click fraud. The Mirai botnet exploited insecure IoT devices such as cameras and routers to launch one of the largest DDoS attacks in internet history. Prevention: change default device passwords, update firmware regularly, disable unnecessary services, monitor unusual network traffic, and secure IoT devices with strong authentication.
7. Cryptojacking
Cryptojacking is the unauthorized use of someone else's computing resources to mine cryptocurrency. Malware infects a device or malicious JavaScript runs in a browser, consuming CPU and GPU resources while attackers earn cryptocurrency and the victim pays the electricity and performance costs. Signs include high CPU usage, loud or constantly running cooling fans, reduced battery life, slow application performance, and overheating. Prevention: install browser security extensions, block malicious scripts, monitor system resource usage, keep software updated, and use endpoint protection.
General Malware Prevention Checklist
Keep operating systems, applications, and firmware updated. Use reputable antivirus and endpoint protection. Enable multi-factor authentication for important accounts. Maintain regular offline and cloud backups. Be cautious of unexpected emails, attachments, and links. Download software only from official sources. Disable macros unless absolutely necessary. Use strong, unique passwords in a password manager. Monitor systems for unusual activity. Educate users about phishing, social engineering, and safe online behavior.
Key Takeaways
Ransomware encrypts data and demands payment, making backups and patching essential. Spyware secretly collects sensitive information and threatens privacy. Adware can expose users to additional threats. Rootkits are difficult to detect and provide hidden, long-term access. Keyloggers silently capture passwords and confidential information. Botnets turn compromised devices into remotely controlled networks used for large-scale attacks. Cryptojacking steals computing power rather than data.
← Back to all articles