15 Different Types of Malware and What They Do

What is malware?

Malware is any software written to damage, disrupt or gain unauthorised access to a device or the data on it. The main types are viruses, worms, trojans, ransomware, spyware, mercenary spyware, adware, keyloggers, rootkits, backdoors, botnet malware, infostealers, banking trojans, cryptojacking malware, and fileless malware. They differ in how they spread, what they take and how visible they are once installed.

Most guides to malware describe a world of desktops and servers. That world has changed. Google’s Android security team reported that Play Protect identified more than 27 million new malicious apps from outside Google Play during 2025, up from 13 million the year before, and blocked 266 million risky sideloading attempts through its enhanced fraud protection, which now covers more than 2.8 billion devices across 185 markets.

The phone in an employee’s pocket is a primary target rather than an afterthought. Verizon’s 2026 breach report found the success rate of mobile social engineering up 40% year on year, with mobile named among the fastest-growing targets.

How many different types of malware are there?

Malware is classified by behaviour rather than by a formal standard, so published lists range from about seven categories to thirty. Most settle on around 15 core types, with newer families such as infostealers and mercenary spyware treated as distinct categories only in recent years.

Real samples combine behaviours: a single dropper delivered through a messaging app may install a banking trojan that also works as a keylogger and a botnet client.

The 15 types of malware at a glance

1. Viruses

A virus attaches itself to a legitimate file or program and spreads when that host is executed, so it needs a user to run something for the infection to progress. The term is often used loosely to mean all malware, but true viruses are now a small share of what security teams encounter. On phones, application sandboxing makes classic viral spread between apps impractical.

2. Worms

A worm copies itself across networks without user action, usually by exploiting a vulnerability in an exposed service. Worms cause some of the fastest-spreading incidents on record because propagation is automatic. They matter mainly on corporate networks and unpatched servers rather than on managed mobile fleets.

3. Trojans

A trojan presents itself as something useful, then delivers a hidden payload once installed. This is the dominant model in mobile malware. Attackers often use a two-stage approach, publishing a clean-looking utility that later fetches the real payload, which is one reason installing apps from outside the official stores carries a different level of risk. Kaspersky’s researchers described that pattern in the second quarter of 2026, when a trojanised PDF reader hosted on Google Play showed users a fake update request in order to drop the Anatsa banking malware.

4. Ransomware

Ransomware encrypts files or locks a device and demands payment for restoration. Most operators now steal data before encrypting so they can extort victims a second time by threatening publication. Verizon’s 2026 Data Breach Investigations Report, which analysed more than 22,000 confirmed breaches across 145 countries, found that 73% of ransomware victims had an associated infostealer infection or credential leak in the year before the attack, and that the median ransom payment fell to around $140,000 with 69% of victims declining to pay. Mobile ransomware remains rare by comparison: Kaspersky counted 570 mobile ransomware installation packages in a quarter that produced more than 304,000 malicious packages in total.

5. Spyware and stalkerware

Spyware monitors activity and exfiltrates what it finds, including messages, location, contacts and microphone audio. Stalkerware is the commercial variant, marketed as parental or employee monitoring and installed by someone with physical access to the device. Both are difficult to detect from the handset itself because they are built to leave no visible trace.

6. Mercenary spyware

Mercenary spyware is a separate class of surveillance implant developed by private vendors and sold to government buyers, and infection often requires no interaction from the target. Apple describes these attacks as vastly more sophisticated than ordinary cybercriminal activity and operates a threat notification system to warn individuals it believes have been targeted, sending a further round of alerts to users across 110 countries in August 2026. Citizen Lab researchers have forensically confirmed cases of journalists compromised by Paragon’s Graphite spyware, including one device attacked through a zero-click iMessage exploit.

Executives, legal teams and anyone handling sensitive negotiations sit closer to this threat than they tend to assume. The delivery methods have shifted over time, from zero-click messaging chains towards web-based exploitation, which we cover in our breakdown of Pegasus and the spyware families that followed it.

7. Adware

Adware injects advertising, redirects browsing and tracks behaviour for resale. It is treated as a nuisance rather than a breach, which is why it persists. The practical harm is data leakage, since adware SDKs bundled into free apps can send device identifiers, location and usage data to parties the organisation has no contract with.

8. Keyloggers

A keylogger records what the user types and returns it to an attacker, which is the simplest route to usable credentials. The mobile equivalent is abuse of accessibility permissions, which allow an app to read screen content and input across other applications. An app that requests accessibility access without an obvious reason should be treated as hostile, and the same applies to the other Android permissions malware relies on, including notification listener access and device admin rights.

9. Rootkits and bootkits

A rootkit modifies the operating system to conceal an attacker’s presence and survive normal clean-up, and a bootkit goes lower still by loading before the operating system does. Both are expensive to build and appear mainly in targeted intrusions. Stock iOS and Android devices resist them, though jailbroken or rooted handsets lose that protection.

10. Backdoors and remote access trojans

A backdoor creates a hidden entry point for future access. A remote access trojan gives an attacker interactive control, including reading files, capturing the screen and switching on the camera or microphone. On mobile they usually arrive inside apps installed outside the official stores, often after a call or message that persuades the user to bypass a security warning, and once installed a remote access trojan inherits every privilege the employee has.

11. Botnet malware

Botnet malware enrols the device into a network of compromised machines directed from a central server. Infected devices are then used for distributed denial of service attacks, credential stuffing, ad fraud or residential proxy services. Handsets are attractive for this because their traffic looks like ordinary consumer activity.

12. Infostealers

Infostealers harvest saved credentials, session cookies, authentication tokens and cryptocurrency wallets in a single pass, then exit. Because they capture live session tokens, they can defeat multi-factor authentication by bypassing the login step entirely. Stolen data is sold on in bulk, which is why an infostealer infection on one device often precedes an apparently unrelated intrusion months later. Kaspersky’s Q1 2026 reporting described a new version of the SparkCat crypto stealer found in apps on both Google Play and the App Store, with the iOS build using Apple’s Vision framework to read text from images held on the device.

13. Banking trojans and overlay malware

Banking trojans wait for a banking or payment app to open, then draw a convincing fake login screen over the top and capture the credentials entered. They are the largest category of mobile malware by volume. In the second quarter of 2026, Kaspersky found that Trojan-Banker samples accounted for 30.77% of detected malicious applications, with 93,574 mobile banking trojan installation packages identified in that quarter alone. The same overlay technique works against corporate single sign-on screens, which is why app risk on employee devices is a credential problem rather than a device hygiene problem.

14. Cryptojacking malware

Cryptojacking malware uses the device’s processor to mine cryptocurrency for someone else. There is no data theft, so it often runs undetected for long periods. On a phone the symptoms are heat, battery drain and throttled performance, which users tend to attribute to an ageing handset.

15. Fileless malware

Fileless malware never writes an executable to disk. It runs in memory and abuses tools already present on the system, such as scripting engines and administrative utilities, which allows it to pass signature-based detection. Defending against it depends on behavioural monitoring rather than file scanning.

Other categories worth knowing

Several further terms appear in malware taxonomies without forming large categories in their own right. Wipers destroy data outright and are used for sabotage rather than extortion. Scareware produces fake infection warnings to sell worthless software. Logic bombs stay dormant until a condition is met. Toll fraud malware silently signs mobile users up to premium-rate services. Droppers and loaders exist only to install something else, which is how an app that passed review can turn malicious later.

What are the dangers of the different types of malware?

Grouped by outcome rather than by family, the damage falls into five categories.

• Financial loss: Ransom payments, fraudulent transactions enabled by banking trojans, and premium-rate charges from toll fraud.
• Data loss and regulatory exposure: Infostealers and spyware remove personal and commercial data. Under GDPR, a notifiable breach brings supervisory authority involvement and potential fines regardless of how the data left.
• Operational disruption: Ransomware and wipers stop the business functioning. The cost sits in downtime and recovery rather than in the ransom itself, and organisations that have never tested whether they can operate with key systems offline tend to discover the answer during the incident.
• Loss of access control: Backdoors, keyloggers and infostealers hand over credentials and session tokens, turning one infected device into a route into every connected system.
• Surveillance: Spyware and mercenary spyware expose negotiations, legal strategy, client information and the movements of named individuals.

What are the different types of malware attacks?

The malware family describes what runs on the device. The attack describes how it arrives.

• Phishing and smishing: A message from a bank, courier or internal service prompting the user to install something or enter credentials. On mobile this arrives through SMS, WhatsApp, LinkedIn and QR codes as readily as through email, and most mobile phishing now lands outside the inbox entirely.
• Sideloading under social engineering: The attacker talks the user through installing an app from outside the store and dismissing the warnings. Google now blocks Play Protect from being switched off during an active phone call because criminals impersonating bank staff walk victims through that step.
• Malicious apps in official stores: Review processes catch most submissions, but dropper apps that fetch their payload after approval still get through.
• Exploitation of unpatched vulnerabilities: Devices running old operating system versions are compromised with no user action at all.
• Malvertising and drive-by downloads: Compromised ad networks deliver payloads to users who only visited a legitimate site, and the same evasion logic drives phishing hidden inside QR codes, where the link is an image that text-based scanning never reads.
• Supply chain compromise: A trusted software component or SDK is modified upstream, so malicious code arrives inside something the organisation chose to install.

Reducing the risk across devices

A layered approach works better than any single control:

• Keep operating systems and applications up to date, since a large share of serious incidents trace back to a small number of known vulnerabilities.
• Restrict installation sources on corporate devices and treat any request to bypass a security warning as a red flag.
• Review app permissions, with particular attention to accessibility services, notification access and device administrator rights.
• Enforce multi-factor authentication alongside controls that detect stolen session tokens, since infostealers are designed to skip the login prompt.
• Maintain offline, tested backups so ransomware becomes a recovery exercise rather than a negotiation.

The gap on mobile

The controls above assume you can see what is happening on the device. On phones that assumption usually fails. Application sandboxing prevents security software from scanning other apps, mobile device management reports configuration state rather than behaviour, and on personally owned devices the work profile deliberately hides the personal side from the organisation.

Attackers work inside that gap, which is covered in our guide to why mobile malware is hard to detect on employee phones and the practical steps in how to improve mobile malware detection on work phones. For a view of how the vendors in this space compare, see our guide to mobile threat defence software.

Corrata provides mobile threat defence for iOS and Android. See how detection and response works on employee devices.