Malware: What It Is and What It Does

Unit V is the largest unit in Dr. Al-Doori's book, and it moves from people to machines. It has three sections: 5A shows how devices are attacked, 5B shows how to protect them, and 5C looks at the connections they use, the web and Wi-Fi. The quotation above comes from Chapter 16, the heart of section 5B. Keep it in mind as you read about threats: every attack in this section is answered by a layer, and no single layer is enough on its own.

This first lesson brings together two of the book's chapters. Chapter 13 sorts malware into families; Chapter 14 describes the jobs malware does once it is inside. Because the two chapters describe many of the same programs from two angles, we teach them together here. Ransomware gets only a short preview, because Lesson 5.2 gives it a full lesson.

What you'll be able to do

Tell the main kinds of malware apart and recognize what they do once installed. By the end of this lesson you will be able to:

• name the main malware families and describe each in one plain sentence;
• explain the jobs malware performs after it gets in, and why most of it now tries to stay hidden;
• spot common warning signs and take sensible first steps with the protection already built into your device.

Malware: Software With Bad Intentions

Malware is short for malicious software: any program written to harm you, your device or your data. Some of it exists to destroy, but most of it today exists to make money for the person who wrote or rented it.

Security software recognizes malware in two broad ways, as Dr. Al-Doori explains. Signature detection compares a program against a database of known threats, a little like checking a face against a wanted poster. Behavioral detection watches what a program actually does, and may test it in a sandbox, a sealed-off space where a suspicious program can run without touching anything important. Neither method catches everything, which is why the book pairs them, and why it also stresses keeping software patched.

The Main Families: What Malware Is

Think of these families as job titles. A single real-world program can hold several titles at once.

The key difference the book draws between a virus and a worm is worth remembering: a virus needs a person to run it, while a worm moves on its own.

What Malware Does Once It Is In

Chapter 14 turns from what malware is to what it does. Dr. Al-Doori describes seven common jobs, which we summarize in our own words:

1. Using up resources. Some malware, especially worms, copies itself so aggressively that the device or network slows to a crawl.
2. Showing unwanted adverts, often without your consent.
3. Spying on your activity and reporting it to someone else.
4. Holding data for ransom.
5. Opening a backdoor, a secret way back in, so the attacker can return later and install more.
6. Switching off your defenses, such as disabling security software or blocking updates, so the infection survives longer.
7. Recruiting your device into a botnet, which can be ordered to flood a website with traffic until it fails. This is called a distributed denial-of-service (DDoS) attack.

The book makes a point that has only grown truer: modern malware prefers to work quietly. A visibly broken computer gets fixed fast; a quiet one keeps earning money for the criminal.

Today's Quiet Thief: the Infostealer

The best example of quiet, profitable malware in 2026 is the infostealer. Its single job is to copy valuable data from your device and send it to criminals. Microsoft Threat Intelligence describes infostealers that collect saved browser passwords, session cookies (the small files that keep you logged in to websites) and cryptocurrency wallets. A stolen session cookie can let a criminal into an account without needing your password at all; Lesson 5.8 explains how.

Infostealers are not just a Windows problem. Microsoft has documented infostealers aimed at Macs as well as Windows PCs, delivered through fake installers and fake "verify you are human" pages. Phones are targets too, which is why Lesson 5.6 is about securing yours. The lesson for everyone: "I use a Mac" or "I have antivirus" is not a reason to relax your other habits.

Signs That Something May Be Wrong

Because modern malware hides, you will not always see symptoms. When you do, they often match the jobs above:

• the device or browser becomes unusually slow, or the fan runs hard when you are doing nothing;
• pop-ups, new toolbars or a changed home page appear that you did not choose;
• your security software has been turned off, will not update, or will not open;
• programs or browser extensions appear that you do not remember installing;
• your accounts send you alerts about sign-ins or password changes you did not make.

That last sign matters most for infostealers, which may leave the device looking normal while your accounts are misused.

The good news is that you already own useful protection. Windows includes Microsoft Defender Antivirus, macOS includes XProtect, and Android phones include Google Play Protect, which checks apps for harmful behavior and is on by default. The UK's National Cyber Security Centre (NCSC) says that simply making sure your computer's built-in antivirus is switched on makes you safer, and that phones need no separate antivirus app as long as you install apps only from official stores. Your job is to make sure this protection is on and updating automatically. If you see warning signs, run a full scan with that built-in tool, install all pending updates, and if any account looks affected, follow the recovery steps in Lesson 6.1.

Real-World Example

In February 2026, Microsoft Threat Intelligence published research titled "Infostealers without borders", describing stealer families aimed at macOS, including one known as Atomic or AMOS, alongside stealers on other platforms. The delivery tricks were social, not technical wizardry: fake software installers and pages that persuaded people to paste a command themselves. Once running, the stealers went after exactly what the infostealer section above describes: saved passwords, browser data and wallets.

Notice how this example combines several families from the table. The fake installer is a Trojan (it pretends to be useful). The stealing is spyware-like behavior. And the whole design follows Dr. Al-Doori's observation that today's malware wants to stay quiet and profitable.

From the Book to 2026

What the book teaches. Chapters 13 and 14 describe eight malware families, seven functions, and two detection methods, signatures and behavior, used together and backed by patching.

Why it made sense. These families and functions are still the standard vocabulary of security, and the book's point that malware has shifted from visible damage to quiet profit remains accurate.

What has changed. Security guidance has evolved since the original text in two ways. First, a newer family, the infostealer, has become one of the most common threats to ordinary users, and it targets Windows, macOS and phones alike. Second, modern platforms have changed this risk: Windows and macOS now include built-in antivirus, and Android phones include Google Play Protect, which is on by default.

What to do now. Current guidance now recommends keeping the built-in protection on and updating, installing updates automatically, getting software only from trusted sources (Lesson 5.3), and protecting your accounts with strong sign-in methods (Unit IV) so that a stolen password or cookie is less useful.

What Would You Do?

Your cousin's laptop has started opening a shopping site every time the browser starts. A new toolbar has appeared, and the built-in antivirus shows as "off" and will not switch back on. Your cousin says: "It's only adware. Annoying, but harmless. I'll ignore it." What would you tell them, and what should they do first? Decide before reading the explanation after the questions.

Knowledge Check

Key Takeaways

• Malware families describe what malware is; its functions describe what it does. One program can do several jobs at once.
• A virus needs you to run it; a worm spreads by itself; a Trojan tricks you into running it.
• Modern malware prefers to stay quiet and make money. Infostealers, which take passwords, session cookies and wallets, are the clearest example, on every major platform.
• Windows and macOS include built-in antivirus, and Android includes Google Play Protect. Keep it on and updating, and watch for signs such as disabled security tools or unexpected account alerts.

Further Study

Optional and external; the lesson is complete without it.

• Hackers & Cyber Attacks: Crash Course Computer Science #32 (CrashCourse) — a lively overview of social engineering, zero-days, worms, botnets and DDoS. The middle section on buffer overflows and code injection is optional technical depth beyond this course, and it predates infostealers and double-extortion ransomware.

Sources

• Microsoft Threat Intelligence — Infostealers without borders: macOS, Python stealers, and platform abuse (2026)
• Microsoft Threat Intelligence — Think before you Click(Fix): Analyzing the ClickFix social engineering technique (2025)
• UK National Cyber Security Centre — What is an antivirus product? Do I need one?
• Microsoft Support — Stay protected with the Windows Security app
• Apple Platform Security — Protecting against malware in macOS
• Google Play Help — Use Google Play Protect to help keep your apps safe & your data private
• Dr. Tahseen Al-Doori — Cyber Security Essentials, Chapters 13, 14 and 16