# What malware is

Hackers use a variety of methods, but their [creativity](mind-creativity.md) means they're *always* finding more.

Malware comes in a variety of forms, and they are not mutually exclusive concepts.

## Appearance

"Viruses" masquerade as other programs, which is [the art of social engineering](cs-infosec-socialengineering.md).

- In fact, many *virus scanners* are actually spyware.

"Trojan horses" or "Trojans" masquerade as non-executing documents.

## OS propagation

"Rootkits" infect the core files of the [operating system](cs-os.md).

"Worms" self-replicate and infect other computers. These can be particularly nasty on [computer networks](cs-networks.md).

- The primary difference between a worm and a virus is that a virus needs user interaction.

"Bots" are hidden software that won't activate until later. They're often easy to install quietly onto computers that people don't use often (such as a smart fridge).

## Tracking

"Spyware" tracks what someone is doing.

- It could include a "keylogger" that tracks what someone types or clicks, capture screenshots, or monitor where someone is using their network.
- The point of spyware is to stay hidden, so it's only detectable with a virus scan.
- However, most people *do* consent to spyware by legal tech companies, which don't openly extort people but still [violate their rights](cs-bigtech.md).

## Modification

"Adware" bloats a computer with ads. These are often *extremely* obvious because your computer has many ads you never expected to see.

"Ransomware" is meant to scare the user into paying an extortion fee, which can often be through [cryptocurrency](cs-blockchain.md) to hide the paper trail. Most ransomware attacks will repeat themselves after the ransom was paid.

PBX hacking takes advantage of a phone system:

1. Call a toll-free line from a phone carrier (most commonly, the voicemail number because the password is the last 4 of that caller's phone number).
2. While on that call, route an outgoing call through that provider's PBX, so the IP address will be trusted elsewhere.
3. When making a paid call, the IP address is trusted, and the costs pass on to the provider instead of the hacker incurring the fees.

A zip bomb is a [file](cs-files.md) that, when interacted with by a decompression [algorithm](cs-langs-algorithms.md), will overwhelm the system. It does this by breaking the rules about [recursion](cs-software.md) and overlapping parts of the code's information.

## Combinations

Naturally, like with any other [programming](cs-langs.md), the quality of the program is based on the quality of its code, and therefore based on the logical talent of the programmer.

Malware often has multiple purposes or design elements, which makes it a "blended threat". For example, a brilliant hacker could create an adware worm packaged as a virus that sends Trojan rootkits that serve as spyware, which is also a bot that activates ransomware at the hacker's command.

An RAT (remote-access Trojan) is when a hacker sends a Trojan masquerading as a software update or stream of data (such as video or music).

## Timing

Not all malware executes immediately.

The software may send information routinely over a network, or may wait until a certain specified time or triggered command.

Also, the software may be fire-and-forget to activate at a certain time, or could be a "remote access tool" (RAT) that can remotely activate software or control a computer over a network.