It is an umbrella category for code that steals data, disrupts services, enables unauthorized control, or conceals other activity. A delivery method, language, or file type alone does not determine whether something is malware.
Labels describe different dimensions: viruses and worms replicate; Trojan horses use deceptive presentation; rootkits conceal privileged presence; spyware and ransomware describe objectives or effects. One specimen can fit several labels, while attackers can also abuse legitimate tools without installing malware.
Key points
Entry and executionMalware may arrive through exploited software, deceptive messages, compromised updates, removable media, unsafe downloads, or prior access. Some code executes through interpreters or trusted system utilities.
AnalysisExamine behavior, code, configuration changes, persistence, communications, and affected assets. Tool and researcher names may differ, so rely on observed properties rather than a family name alone.
ResponseScope the activity, preserve evidence, contain harmful execution and communications, remove persistence, correct the entry path, and recover from known-good sources.
Important limitationA malware alert does not prove the actor, objective, scope, or impact. A clean scan also does not establish that a system is uncompromised; detection depends on visibility, coverage, and analytic knowledge.