Common types of malware and how to protect against them

With employees working from the office, from home or from their phones, the security and integrity of company data are absolutely essential.

In this article, we set out to review the most common forms of malware and, at the end, what a company should do to protect itself against malware and keep its data intact.

This is an informational article, so we won’t bombard you with technical details. The aim is to explain briefly what the types of malware are, so you can recognize them more easily and avoid them as much as possible.

In everyday terms, we’re talking about “computer viruses.” Although malicious programs are generically called viruses, viruses are really just one form of malware.

What are the common types of malware?

The common types of malware are viruses, worms, trojans, ransomware, password-stealing programs (infostealers), adware and spyware. Let’s take them one at a time.

Viruses

Viruses are harmful applications capable of modifying legitimate system files. They run at the same time as the applications they infiltrate. One characteristic of this type of malware is that it can also infect other files on the system.

Because viruses hide behind legitimate files, antivirus solutions usually offer to move the infected file to quarantine or delete it, since actually disinfecting it is quite difficult.

Paradoxically, classic viruses have become rare: most of today’s threats are trojans, ransomware and data-stealing programs.

Computer worms

Computer worms are a very old form of malware. The first famous worm, Morris, appeared in 1988, and in the 1990s and 2000s worms spread mainly through email. For a decade, worms gave the people in charge of IT security huge headaches.

Back then, a single computer worm launched from an email could compromise an entire company’s data in a fairly short time.

Worms are very dangerous because they spread very easily, without users having to do anything. A few computer worms that made history are SQL Slammer and Blaster, both from 2003. Worms haven’t disappeared: in May 2017, WannaCry combined a worm with ransomware and spread around the world through a Windows vulnerability for which an update already existed. Computers that had been updated in time were protected.

Trojans

Today, attackers prefer trojans to worms. Like viruses, trojans hide inside applications that look legitimate but also contain malicious instructions.

A trojan has to be started by the user to be “activated.” Most of the time, trojans are disguised as security solutions or as programs that offer to clean up and optimize your computer. Other common traps are pirated software, fake browser updates, ads that lead to fake download sites and pages that ask you to “confirm you’re not a robot” by pasting a command into Windows (a technique known as ClickFix).

One of the common types of trojans is the RAT (Remote Access Trojan). A RAT lets hackers gain access to the victim’s workstation, and this is quite hard to detect.

Ransomware

Ransomware is a type of malware that encrypts users’ legitimate data and demands a ransom to recover it. This type of cyber threat has gained a lot of ground in recent years, which has even led to the rise of RaaS (ransomware as a service, services that let anyone launch ransomware attacks).

Ransomware gets into the network the same way trojans do, through social engineering (tricking users into starting it), but also through stolen passwords and unpatched vulnerabilities in network equipment.

The data is encrypted in such a way that, once “hit,” the information can no longer be recovered without the attackers’ key, unless the company uses an effective backup solution. What’s more, most groups steal the data before encrypting it and threaten to publish it.

Password-stealing programs (infostealers)

Infostealers are trojans that specialize in stealing data: passwords saved in the browser, sessions that are already open (the cookies that keep the user logged in), card details and cryptocurrency wallets. The stolen data is then sold to other criminals, who use it to break into the company’s accounts, sometimes even getting around two-step verification by using the stolen sessions.

The problem is widespread. In May 2025, Microsoft, together with the US Department of Justice, Europol and other partners, took down the infrastructure of the Lumma infostealer: about 2,300 domains. Between March 16 and May 16, 2025 alone, Microsoft had identified more than 394,000 Windows computers infected with Lumma worldwide.

Adware

This type of malware displays various advertising messages on users’ workstations. Most of the time, a computer infected with adware will open various malicious websites while you browse the internet.

Spyware

Spyware is a type of malware that spies on users’ activity. Most of the time, it’s used to “discover” sensitive information that users type.

Ordinary spyware, like adware, is fairly easy for antivirus solutions to detect and remove. The exceptions are commercial spyware programs used in targeted attacks, which are much harder to detect.

IT services for companies: tell me more →

How can a company protect itself against malware?

To protect and secure your company’s data, we recommend that you:

• implement a multi-layered security system;
• implement an effective backup solution;
• use antimalware solutions that can be managed centrally;
• train users to recognize and avoid the most common threats on the internet;
• keep operating systems and applications up to date;
• protect accounts with two-step verification.

Let’s take these ideas one at a time.

A multi-layered security system protects your company’s entire infrastructure, and if a threat gets past the first “shield,” it can be stopped by the next one: firewall, email filtering, antimalware solutions, security restrictions. A simple and very effective restriction: users don’t work with administrator rights day to day, so they can’t install programs on their own.

An effective backup solution lets you quickly restore data that has been compromised by ransomware. At least one copy must be kept outside the company network, where an attack can’t encrypt it. See also Backup as a Service.

Centrally managed antimalware solutions (including EDR solutions, which watch how programs behave, not just the signatures of known viruses) let system administrators actively monitor workstations and stop an infection before it spreads.

However, any security system can be bypassed through its users. That’s why we recommend training that teaches users how to protect themselves from the most common attacks, first and foremost phishing.

Updates close the vulnerabilities that worms and ransomware exploit. A system that is out of support no longer receives these fixes: Windows 10, for example, hasn’t received free security updates since October 14, 2025. See how to upgrade to Windows 11 for free and our article on end-of-life (EOL) technologies.

Two-step verification means that a password stolen by an infostealer is no longer enough for the attackers. Details in our article with basic rules for creating strong passwords.

RezolvIT is a managed IT services company in Bucharest, certified to ISO/IEC 27001, that handles IT security, backup and infrastructure management for companies of all sizes. We start with a free IT audit, which also gives you the exact price.