Malware
Malware is malicious software built to damage, steal or take over systems — viruses, trojans, ransomware, spyware and the payloads botnets deliver.
Protect Against Bot-Driven Threats
Defend your platform with advanced bot protection
What is Malware?
Malware is software written to do something the owner of the device would not consent to: steal data, encrypt files for ransom, mine cryptocurrency, or hand remote control to someone else.
It is a device and endpoint problem rather than a web traffic problem, and the distinction matters when deciding what defends against it. Nothing at the website layer stops malware; what the website layer deals with is the traffic malware generates once it is running.
The main families
| Family | Behaviour |
|---|---|
| Ransomware | Encrypts files or systems and demands payment |
| Infostealer | Harvests saved passwords, cookies and session tokens, then exits |
| Remote access trojan | Gives an operator interactive control of the machine |
| Banking trojan | Intercepts or alters transactions in the browser |
| Cryptominer | Consumes the victim's CPU for the attacker's profit |
| Loader | Establishes a foothold, then installs whatever has been paid for |
Infostealers deserve particular attention, because their output is the raw material for the attacks a website actually sees. A stealer takes the browser's cookie jar, and a stolen session cookie does not need the password or the second factor — it is already authenticated.
How it arrives
Phishing attachments and links, malicious advertising, compromised software updates and installers, and exposed remote-access services with weak credentials. The trend over the past few years has been away from exploiting software vulnerabilities and towards simply persuading a person to run something, because that is cheaper and works more reliably.
The connection to bot traffic
A compromised machine with a remote access trojan becomes part of a botnet, and botnets are the delivery mechanism for much of what arrives at a website:
- Distributed credential stuffing from thousands of residential addresses
- DDoS traffic
- Residential proxy capacity, sold on to whoever wants to look like a home user — which is why address reputation is a weak signal for conviction
This is the practical link worth understanding: malware on consumer devices is what makes attacker traffic look like it comes from ordinary households, and that is why defences based on identifying where a request came from have steadily lost ground to defences based on whether a person is behind it.
What actually reduces malware risk
In order of effect: patch promptly, remove local administrator rights, require phishing-resistant authentication so stolen passwords are less useful, keep tested offline backups, and use endpoint detection with somebody actually reading its alerts. Antivirus signature matching is the least effective item on that list and usually the one with the biggest budget line.