Malware

Malware, short for malicious software, is any program or code written to damage, disrupt or gain unauthorised access to a computer, phone, server or network, or to the people who use them. It covers a wide family of threats, from self-spreading viruses and worms to programs that quietly steal passwords, encrypt files for ransom or hijack a device's processing power. In financial crime, malware is one of the main tools for stealing bank credentials, card data and cryptocurrency.

Malware is distinct from a software bug: it is written on purpose to cause harm or benefit the attacker. It often works together with social tricks such as phishing, which persuade the victim to open an attachment or install a program. Defending against it is a central part of managing cybersecurity risk for banks, payment firms and individuals.

Think of a house where a visitor has been let in under false pretences. Some visitors break things, some copy the house keys, some lock the owners out of their own rooms and demand money to open them, and some move in secretly and use the electricity. Malware is the software version of those unwanted guests.

Usually the victim lets it in without realising, by clicking a link, opening a file or installing an app that looks genuine. Once inside, it does whatever its author designed it to do, often without any visible sign, until money goes missing or files can no longer be opened.

• Viruses and worms. Viruses attach themselves to files and spread when those files are shared; worms copy themselves across networks without any help from users.
• Trojans. Programs that pretend to be useful software but carry hidden harmful functions, including banking trojans that alter online banking pages or capture logins.
• Ransomware. Software that encrypts files or locks systems and demands payment, often in cryptocurrency, to restore them; see ransomware.
• Spyware and keyloggers. Tools that monitor activity and collect data, such as the keylogger, which records keystrokes.
• Information stealers. Programs that harvest saved passwords, browser cookies, crypto wallet files and seed phrases in one sweep and upload them to the attacker.
• Cryptojacking software. Code that secretly uses the victim's computer to mine cryptocurrency, covered under cryptojacking.
• Clipboard hijackers. Malware that watches for a copied wallet address and swaps it for the attacker's address at the moment of payment.
• Botnets. Networks of infected devices controlled remotely and used for spam, fraud or denial-of-service attacks.

Common infection routes include email attachments and links, fake software updates, pirated programs and games, malicious advertisements, compromised websites and infected USB drives. On phones, malicious apps sometimes slip into official app stores or are installed from outside them. Attackers also exploit software flaws, sometimes before a fix is available, and target browser extensions, since a compromised extension can read and change what a user sees on banking and crypto sites. In crypto, fake wallet apps, counterfeit trading tools and job offers that ask candidates to run "test" code are frequent lures.

For criminals, malware turns into money in several ways: emptying bank and crypto accounts, selling stolen data, extorting ransom payments and renting out infected machines. Banking trojans have been used to steal from online banking customers worldwide since the late 2000s. Ransomware attacks on hospitals, councils and companies have grown into a large criminal industry, with payments typically demanded in bitcoin or privacy coins. Stolen login data also feeds account takeover and identity theft.

Crypto holders face particular risk because transfers are fast and usually irreversible. If malware obtains a seed phrase or private key, the attacker can drain the wallet from anywhere in the world.

• Updating software promptly closes known security holes.
• Using reputable security tools, including antivirus software and built-in operating system protections.
• Installing only from trusted sources and checking app publishers and reviews carefully.
• Using strong authentication, such as two-factor authentication with hardware keys, so stolen passwords are not enough on their own.
• Keeping crypto keys offline with a hardware wallet, and checking every receiving address on the device screen before confirming a payment.
• Backing up data offline, so ransomware cannot force a payment.

Victims are usually advised to disconnect the affected device, move funds from accounts that may be compromised using a clean device, change passwords and report the incident to their bank and to the police or national cybercrime agency. Paying ransoms is discouraged by law enforcement and, where the attackers are sanctioned, can itself be illegal.