How Malware Spreads

Malware is software written to harm a computer, its data or the person using it. It cannot get onto a device by itself — it needs a route in, and most routes involve something you open, install, click or plug in.

Ways malware gets in

• Infected email attachments — a file attached to a message, such as a photo or a form to fill in, that carries malware. Opening the file runs the hidden code, so a message that looks ordinary can still be dangerous.
• Untrusted downloads — installing a program from a website you do not know or trust. Something extra can be bundled in with the program you actually wanted.
• Links in phishing messages — a message pretending to be from a company you use, pushing you to click. The link downloads malware instead of opening the page it promised.
• Infected removable storage — a memory card from a camera or a borrowed external drive carries the malware with it. Open a file on it with a clean computer and the malware travels across.
• Unpatched software — software that has not been updated still contains known weaknesses. Malware written to exploit one gets in without you doing anything at all.

Hidden on purpose

Malware is usually disguised: a file name that sounds like something ordinary, an icon that copies a well-known app, or a folder you would never think to check. You run it without realising, which is exactly what the attacker is relying on.

A threat to the whole network

Once malware is running on one computer attached to a network, it can spread to the other computers on that network. That is the real threat: a single careless click can put every machine in a school or office at risk, not just the one it landed on, so the damage reaches far beyond the original device.