# What is a Trojan Horse?

> A Trojan horse is a program or package presented as useful, benign, or expected while containing a hidden malicious function.

- Canonical URL: https://yellowcube.eu/glossary/trojan-horse/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It relies on deception and the trust or authorization of whoever invokes it. Unlike a virus or worm, the label does not require a Trojan horse to replicate or propagate.

A Trojan horse may appear as an installer, update, document, utility, mobile application, or modified program. Once invoked, it may steal data, establish remote access, change settings, or install malware. Those actions can add classifications; “Trojan horse” primarily describes how its malicious nature is concealed at delivery or execution.

### Key points

- **Delivery:** Phishing, unsafe downloads, compromised distribution, misleading advertisements, and unauthorized bundles can present a Trojan horse to a user or automated process.
- **Trust abuse:** A convincing name, interface, signature, or source can influence execution but does not establish provenance. Installation may inherit the invoker’s permissions.
- **Investigation:** Determine what was represented, what ran, its source and integrity, privileges, persistence, communications, installed components, and distribution.
- **Important limitation:** “Trojan” does not describe one payload or prove that a user knowingly enabled an attack. A deceptively named file is not a Trojan horse unless it contains or launches hidden malicious functionality.

### Related terms

[Malware](<https://yellowcube.eu/glossary/malware/>) · [Remote access trojan (RAT)](<https://yellowcube.eu/glossary/remote-access-trojan/>) · [Computer virus](<https://yellowcube.eu/glossary/computer-virus/>) · [Computer worm](<https://yellowcube.eu/glossary/computer-worm/>) · [Phishing](<https://yellowcube.eu/glossary/phishing/>)

### Sources

[NIST glossary: Trojan Horse](https://csrc.nist.gov/glossary/term/trojan_horse) · [NIST SP 800-83 Rev. 1: Guide to Malware Incident Prevention and Handling](https://csrc.nist.gov/pubs/sp/800/83/r1/final) · [NIST SP 800-12 Rev. 1: An Introduction to Information Security](https://csrc.nist.gov/pubs/sp/800/12/r1/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.