Cybersecurity Technologies

Malware

Malware is any software intentionally designed to cause harm to a computer, server, network, or user. Short for "malicious software," malware encompasses a broad category of threats including viruses, worms, trojans, ransomware, spyware, and adware, each with different infection methods, behaviors, and objectives ranging from data theft to system destruction.

Malicious software designed to gain unauthorized access or cause damage, including viruses, spyware, and ransomware.

What is malware?

Malware is the umbrella term for software designed to do things you don't want: steal your data, encrypt your files, spy on your activity, hijack your computing resources, or destroy your systems. It's one of the oldest categories of cybersecurity threats and remains one of the most prevalent.

The major types of malware include:

Ransomware. Encrypts your files and demands payment for the decryption key. The most financially impactful malware category for businesses.
Trojans. Disguised as legitimate software, trojans create backdoors that give attackers persistent remote access to compromised systems.
Worms. Self-replicating malware that spreads across networks without user interaction, exploiting vulnerabilities to propagate automatically.
Spyware. Silently monitors user activity, capturing keystrokes, screenshots, credentials, and other sensitive data.
Infostealers. Specifically designed to extract stored credentials, browser cookies, cryptocurrency wallets, and authentication tokens.
Cryptominers. Hijack computing resources to mine cryptocurrency, degrading system performance and increasing cloud costs.

How malware reaches your systems

Modern malware rarely arrives through a single channel. Common delivery methods include:

Phishing emails. Malicious attachments (Office documents with macros, PDF files, compressed archives) or links to drive-by download sites. Phishing remains the most common malware delivery vector.
Compromised software supply chain. Malware injected into legitimate software packages, open-source libraries, or vendor update mechanisms. The attacker compromises the supply chain, and legitimate users install the malware themselves.
Exploit kits. Automated toolkits hosted on compromised or malicious websites that probe visitors' browsers and plugins for vulnerabilities and deliver malware through discovered weaknesses.
Removable media and physical access. USB drives and other removable media that auto-execute malware when connected. Less common in cloud-native startups but still relevant.

Why malware matters for startups

Infostealers target developer credentials. Developer workstations are high-value targets because they contain credentials for code repositories, cloud consoles, CI/CD pipelines, and production infrastructure. A single infostealer infection on a developer's laptop can give attackers access to your entire stack.
Cloud costs spike from cryptominers. Cryptomining malware that compromises cloud compute instances can generate massive, unexpected cloud bills. Startups have reported five-figure bills from compromised AWS or GCP accounts running unauthorized mining operations.
Ransomware is existential for small businesses.
Compliance requires malware controls. SOC 2 and ISO 27001 both expect endpoint protection, malware detection, and incident response procedures for malware events. Auditors will ask what controls you have in place.

Startup-friendly malware defenses

Endpoint detection and response (EDR). Tools like provide real-time malware detection and response on workstations and servers. Many offer startup pricing.
Email security. Cloud email filtering catches most commodity malware before it reaches inboxes.
Least-privilege access. If malware infects a developer's laptop, least-privilege IAM policies limit what the attacker can access with the compromised credentials.
SCA for supply chain malware. Software Composition Analysis detects known malicious packages in your dependencies before they reach production.

Frequently asked questions

What's the difference between malware and a virus?

A virus is a specific type of malware. Malware is the broad category that includes all malicious software: viruses, worms, trojans, ransomware, spyware, and more. A virus specifically refers to malware that attaches itself to legitimate programs or files and spreads when those infected files are shared or executed. The term "virus" is often used colloquially to mean any malware, but technically it's just one subcategory. In modern cybersecurity, ransomware, infostealers, and trojans are far more common threats to businesses than traditional file-infecting viruses.

Can malware infect cloud infrastructure?

Yes. While traditional malware targeted desktop operating systems, modern malware can compromise cloud workloads, containers, and serverless functions. Attackers deploy cryptominers on compromised cloud instances, install backdoors in container images, or inject malicious code into CI/CD pipelines. Cloud-specific malware often leverages stolen credentials or misconfigured services rather than exploiting software vulnerabilities directly. Protecting cloud infrastructure requires a combination of CSPM (for misconfiguration detection), strong IAM policies, container image scanning, and runtime monitoring.

How do I know if my systems are infected with malware?

Common indicators include unexpected system slowdowns or high CPU usage (possible cryptominer), unusual network traffic to unknown destinations (possible data exfiltration or command-and-control communication), unauthorized changes to files or configurations, unexpected cloud resource provisioning, new user accounts or elevated permissions you didn't create, and disabled security tools. EDR solutions automate much of this detection. For cloud environments, monitor CloudTrail or equivalent audit logs for unexpected API calls. Many infections are discovered only during incident response, which is why prevention and monitoring are both essential.

Related terms

Take Fencer for a spin

See what security handled from code to cloud looks like.
Start a free trial in minutes, or book a demo for a guided tour.

Start Securing Free Book a Demo