needsnointro

Malware

Malware is software that works for the wrong boss, and most infections start with someone just clicking.

By Greg Goodwin · Published November 4, 2026

Malware

Cheat Sheet

  • NIST wording: malware is software or firmware intended to perform an unauthorized process that harms confidentiality, integrity, or availability.
  • Morris worm: released November 2, 1988; damage estimates run from about $100,000 to $10 million.
  • Legal first: Robert Tappan Morris became the first person prosecuted under the 1986 Computer Fraud and Abuse Act.
  • WannaCry: May 2017, reportedly about 200,000 computers in roughly 150 countries.
  • Patch gap: Microsoft patched the flaw WannaCry used on March 14, 2017, about a month before it was leaked.
  • Double extortion: modern ransomware crews encrypt files and also threaten to leak stolen data.

The 60-Second Version

Malware, short for malicious software, is any program built to do something unauthorized and harmful to a computer, network, or the people using it. NIST's glossary defines it as software or firmware intended to perform an unauthorized process that harms the confidentiality, integrity, or availability of a system. The family includes viruses, worms, Trojan horses, spyware, and ransomware. The labels describe different things: a worm is defined by how it spreads, a Trojan by how it tricks you, and ransomware by what it demands, so one piece of malware can fit several. Most infections begin with ordinary actions, like opening a disguised attachment, running software from an untrusted source, or leaving a known flaw unpatched. Good habits, updates, backups, and cautious clicking prevent a great deal of damage.

The Long Version

What Counts as Malware

NIST's glossary collects several official definitions, and they share the same core: software, firmware, or sometimes hardware that is inserted into a system, usually covertly, to compromise the confidentiality, integrity, or availability of the victim's data, applications, or operating system, or simply to disrupt the victim. Notice what the definition leaves out. It does not require a particular technique or a particular culprit, only intent. A program is malicious because of its purpose, not its code. That is why security people prefer the broad term malware over narrower words like virus, which people often use incorrectly for everything.

The Usual Suspects

Viruses attach to files or programs and spread when those are run. Worms replicate on their own across networks. Trojans pose as something legitimate to get installed. Spyware watches what users do, and ransomware locks up files for payment. Categories overlap constantly, and a single family can combine several. WannaCry is often given as the example, since it spread like a worm while carrying a ransomware payload. The point for ordinary users is that you do not need to memorize the zoo. The defenses, which are updates, backups, caution with attachments and downloads, and security software, work against most of it.

Two Famous Outbreaks

The Morris worm was released on November 2, 1988, and affected VAX computers and Sun-3 workstations running Berkeley UNIX. Its author, Cornell graduate student Robert Tappan Morris, reportedly meant to gauge the size of the early internet, but a coding choice made it re-infect machines and cause far more damage than intended. Estimates of cost range from $100,000 to $10 million, and counts of infected machines run from a couple thousand to about 6,000. Morris was the first person prosecuted under the 1986 Computer Fraud and Abuse Act, and the CERT Coordination Center opened before the end of the year. In May 2017, WannaCry hit an estimated 200,000 computers across roughly 150 countries, disrupting hospitals in the UK. It exploited a Windows flaw Microsoft had patched on March 14, yet many systems remained unpatched. A researcher's kill-switch domain limited its spread.

Ransomware and Double Extortion

CISA describes ransomware as a form of malware designed to encrypt files on a device so they and the systems relying on them become unusable, after which the attackers demand a ransom for decryption. Over time, CISA says, criminals have made tactics more destructive, adding the theft of victim data and threatening to publish it, a combination called double extortion. In some cases attackers steal data and threaten to release it without using ransomware at all. The impact can leave organizations unable to access data needed to operate and deliver critical services, and recovery can be long and costly for organizations of every size.

Staying Safe in Plain English

CISA's guide groups prevention advice by common ways attackers get in, and the general lessons are familiar. Keep software updated, since WannaCry shows what a missed patch costs. Keep offline or otherwise protected backups so that encrypted files can be restored without paying. Be skeptical of unexpected attachments and links, use unique passwords with multi-factor authentication, and have a response plan before you need one. For organizations, CISA also publishes a response checklist. If you think a device is infected, disconnect it from the network and ask a qualified professional, rather than experimenting.

Why People Care

Malware is how most cybercrime gets in the door, hitting individuals, hospitals, schools, and businesses alike. Knowing the basic terms and a few unglamorous habits, like patching and backups, is one of the cheapest ways to avoid being the next headline.

Glossary

Virus
Malware that attaches itself to a program or file and spreads when that file is run or shared.
Worm
Self-replicating malware that spreads across networks on its own, without a user opening anything.
Trojan
Malware disguised as something useful or harmless so that the user installs it.
Ransomware
Malware that encrypts files on a device so they cannot be used, then demands payment for decryption.
Patch
A software update that fixes a security flaw so attackers can no longer use it.

Go Deeper

More to Explore

🎲 Take Me Somewhere Random