← All lessons
Threats · Beginner · 4 min
Malware families
Trojans, worms, stealers, RATs: know what you're looking at.
What it is
Malware is any software built to cause harm. A trojan pretends to be something useful. A worm spreads by itself between machines. An infostealer grabs saved passwords, cookies and crypto wallets. A RAT (remote access trojan) gives the attacker control of your machine. A loader's only job is to download other malware. A botnet is thousands of infected devices taking orders from one controller.
Real case · 2017
WannaCry
A ransomware worm used a leaked NSA exploit (EternalBlue) to spread across unpatched Windows machines worldwide in hours, hitting the UK's NHS hard. Microsoft had released the patch two months earlier.
Source: Wikipedia: WannaCry ransomware attack
How defenders stop it
- Keep systems patched so worms have nowhere to spread
- Only install software from trusted sources
- Use EDR and application allow-listing
- Don't let browsers store high-value passwords on shared machines
Check yourself
1. Which malware type steals saved browser passwords and session cookies?
- Worm
- Infostealer
- Loader
- Adware
Show answer
Infostealer. Infostealers are a big driver of account takeovers because stolen cookies can bypass MFA.
2. Which type of malware spreads between machines by itself, without anyone clicking anything?
- Loader
- Worm
- Trojan
- Infostealer
Show answer
Worm. A worm spreads on its own, which is why keeping systems patched (leaving it nothing to exploit) matters so much.
3. A program's only job is to download and run other malware. What is it?
- A RAT
- Adware
- A loader
- A botnet
Show answer
A loader. A loader fetches the next stage. Blocking it stops everything that would have followed.
Answer them in the app to earn XP.
Next: Zero-days →