A trojan (or trojan horse) is malicious software that disguises itself as something useful — a free PDF converter, an invoice, a software update, a game — to get a user to install it willingly. Unlike a virus or worm, a trojan cannot spread by itself: it needs a person to run it, which is why trojans remain one of the most common malware infections on business machines in 2026, and why the fix is as much about people as software.
TL;DR
- A trojan is malware disguised as legitimate software; the user installs it themselves.
- Common disguises: invoice attachments, fake updates, cracked apps, browser “cleaner” tools.
- Modern trojans steal passwords, crypto wallets and browser sessions — or hand over remote control of the machine.
- Anti-malware catches known trojans; fresh builds slip past, so patching, admin rights and trained staff carry the rest.
- Cyber Aware's phishing simulations rehearse the exact delivery moment — the click — that defeats every other control.
What is a trojan?
The name comes from the wooden horse: the gift gets taken inside the walls, and the danger is already in. A trojan is any malicious program delivered wrapped in something that looks harmless or useful. What separates it from other malware classes:
- No self-replication. A virus copies itself into files; a worm spreads across networks alone. A trojan waits to be run.
- User participation. The infection requires a click, a download, an “open” — which puts it squarely in the overlap between malware and social engineering.
- Payload variety. The disguise is the shell; what comes out can be a password stealer, a keylogger, a ransomware loader, a remote-access backdoor or a crypto miner.
The trojan families that hit businesses
- Banking trojans. Overlay fake login screens or intercept SMS codes to drain accounts. Some disguise themselves as Android accessibility apps or fake bank security alerts.
- Remote access trojans (RATs). Give the attacker live control of the machine — files, webcam, keystrokes. Often the payload behind “tech support scam” remote tools.
- Downloader trojans. Small, quiet, and built to fetch bigger malware — frequently the first stage of a ransomware incident.
- Infostealers. Sweep saved browser passwords, cookies and session tokens — the credentials that circulate on criminal marketplaces for months.
- Fake installer trojans. The free PDF converter, the cracked design suite, the “required” browser update. The most common disguise small businesses meet in 2026.
How a trojan gets in
- The lure. An email attachment (“invoice overdue”, “voice message”), a download link, a pop-up offering an update, or a poisoned search result.
- The install. The user opens it. On machines where staff run with admin rights, the trojan gets system-level access immediately.
- The payload. Credentials are swept, sessions stolen, or a downloader fetches the second stage.
- The aftermath. Passwords circulate, accounts get taken over, and the infection may wait quietly for weeks before anyone notices.
Warning signs of a trojan infection
- The device slows noticeably, or the fan runs constantly.
- Browser settings or the homepage change on their own.
- Unknown programs appear in the installed-apps list.
- Colleagues receive messages the user never sent.
- Security tools get switched off, or new admin prompts appear that nobody requested.
None of these alone proves anything, and a well-built trojan shows nothing at all. The pattern — several symptoms together, or several machines behaving oddly in the same week — is what justifies a scan and a credential rotation.
How to stop trojans
- Endpoint protection on every device, kept current, with behaviour-based detection rather than signatures alone.
- Take admin rights away from daily accounts. Most trojans need elevated rights to persist; a standard user account starves them.
- Patch operating systems and browsers. Some trojans install through exploited vulnerabilities rather than an agreed prompt.
- Restrict installs to approved software. “Free converter” downloads are guilty until proven innocent.
- Train the click. The trojan's entire strategy is one ordinary decision under time pressure. Cyber Aware's phishing simulations rehearse that exact moment monthly, and anyone who clicks lands in same-day remediation training — practice, not punishment. Human risk reporting shows whether click rates are actually falling per person.
- Back up properly. Offline or immutable backups turn the worst trojan outcome — a ransomware loader — from a catastrophe into an afternoon of restoration.
Trojan vs virus vs worm
| Trojan | Virus | Worm | |
|---|---|---|---|
| Spreads by | User runs it | Attaching to files users share | Copying itself across networks |
| Needs a click? | Yes — always | Usually | No |
| Typical payload | Stealers, RATs, ransomware loaders | File corruption | Bandwidth abuse, more malware delivery |
| Main defence | Trained staff, least privilege | Anti-malware, patching | Network segmentation, patching |
All three are malware; the distinction matters because the defences differ. A trojan's dependence on a human click is exactly what makes security awareness training the control that closes it.
FAQ
What is a trojan in simple terms? Malware disguised as legitimate software. You install it thinking it is something useful — an invoice viewer, an update, a free tool — and it steals data, takes control or installs worse malware.
How is a trojan different from a virus? A virus copies itself into other files and spreads when they are shared. A trojan never self-replicates; it relies entirely on a person running it, which is why staff awareness matters more for trojans.
What are common trojan disguises? Invoice and résumé attachments, fake browser or system updates, cracked commercial software, free PDF converters and cleaner apps, and malicious browser extensions.
Can antivirus remove a trojan? Known trojans, usually yes. Freshly built variants evade signature detection, which is why behavioural endpoint protection, restricted admin rights and trained staff all carry part of the load.
What should I do if a trojan got on a work computer? Disconnect the device from the network, run a full scan with updated endpoint tools, remove unknown apps and extensions, then rotate every password typed on that machine from a different, clean device — and check email forwarding rules.
One last thing
One rule removes most trojan risk in one afternoon: move every staff account from administrator to standard user. Without elevated rights, most trojans cannot install, persist or spread — and the daily workflow barely changes.