Fileless malware Fileless malware never writes itself to disk during the attack, so antivirus software has a harder time finding it. While it operates it lives in memory and wor …

Backdoor … the ordinary records. A backdoor can be opened by malware while it runs, but it can equally be a user account nobody watches, or web shell access left on a serv …

Cryptominer A cryptominer steals what we rarely think of as a target: our computing power and our electricity. In the background it uses our processors and graphics cards to mine cryptocurrency for the attacker while we pay the bill. It has no interest in our data, only in our resources and how much of them there is.

Infostealer An infostealer has one basic role: to collect your credentials. Saved browser passwords, cookies and session tokens, autofill data, crypto wallet keys — all of it is of interest. It stays in contact with the attacker and sends on what it gathers. When the job is done it can delete itself and disappear.

Keylogger A keylogger is a program or hardware device that records every keystroke. Software keyloggers run covertly in the background, while hardware variants can be physically attached between the keyboard and the computer.

Loader / Dropper … somware, infostealers, remote access tools, other malware. Loaders are now rented out as a service — attackers pay to have their cargo smuggled in.

Remote access trojan - RAT … it works interactively, it is more dangerous than malware programmed in advance for a fixed set of functions.

Rootkit … e administrator looks at a clean system while the malware operates beneath the security tools.

Spyware On a computer it usually arrives alongside other malware or through an exploited vulnerability. On a phone it is worse — advanced surveillance tools can install …

Trojan A Trojan does not break in; the victim opens the door. It usually presents itself as something useful — a program or a document, a fake installer, a cracked application, or a harmless-looking tool for speeding up the computer. The user runs what they meant to run, and the attacker gets what they were after.

Virus … e early two-thousands it was the dominant form of malware; today it has been pushed aside, because attackers prefer quiet threats that bring money to noisy ones …

Wiper A wiper does not exist to steal or to extort — a wiper destroys data. It erases and overwrites, breaks file systems, and combined with worms and zero-day vulnerabilities it can bring down hundreds or thousands of networks within hours. Unlike ransomware it offers no ransom; recovery was never part of the plan, because the aim is damage, not money.

Worm A worm spreads on its own. Unlike a virus it needs no host file and no click from the user — once it is on one machine it immediately looks for the next, and the next, and thousands of devices can be infected within minutes. Replication is its purpose, speed is its weapon, and whatever it carries is the real threat.

API Abuse … e they look like normal traffic. There need be no malware, no link, no file. There are only requests, tokens, parameters and a pace that suddenly resembles a sc …

Account Takeover … to malicious content, send fake invoices, deliver malware — all while the owner's contacts trust it, because the account is genuine. The most dangerous part is …

Botnet Attacks … paigns, password spraying, cryptocurrency mining, malware distribution and other work that needs quantity. The strength of a botnet is not in one device but in …

Business Email Compromise … ous. No attachment, no malicious link, no obvious malware. The message can be short, polite and businesslike. "Can this go out today?", "The supplier has change …

DNS Poisoning … fake page, intercept communication, or distribute malware from somewhere that resembles the legitimate source.

Phishing … voice or a purchase order, which actually carries malware.

SCADA/OT Attack Malware in an OT environment interrupts the HMI stations and makes it harder for operators to control the process.

Session Hijacking … e site that allows the cookie to be read, or with malware. Identifiers can also be predicted when the service generates them by a weak and foreseeable pattern. …

Spear Phishing … he minutes attached — and the attachment carrying malware.

Token Theft Tokens are mostly stolen in three ways. Malware on the device reads them straight from the browser store or from application memory. Adversary-in-the-middle phi …

Typosquatting … but ends up on a fake page for credential theft, malware distribution or advertising. With software packages, a developer installs a package whose name resembl …

USB Drop Attack … he USB need not be ordinary storage. It can carry malware, a fake document, a script, or a device that presents itself to the computer as a keyboard and types c …

Watering Hole Attack … or a narrow professional group is used to deliver malware unnoticed to targeted visitors.