A trojan virus — usually just called a trojan — is malicious software that hides inside something that looks useful: a free PDF converter, a cracked game, an urgent invoice attachment, a fake software update. The name comes from the Trojan Horse of Greek legend, and the mechanism is identical: you invite it in yourself, and the payload comes out once it is inside. It is the single most common delivery vehicle for malware aimed at small businesses.
TL;DR
- A trojan disguises itself as legitimate software or a genuine file, and the user installs it willingly.
- It is a delivery wrapper, not one behaviour: the payload inside can be ransomware, spyware, a keylogger or a remote-access backdoor.
- Trojans arrive via phishing attachments, fake download sites, malvertising, and trojanised updates.
- Signs: unexplained installs, new startup entries, devices contacting unfamiliar servers, sudden credential alerts.
- Detection is a mix of endpoint tools and staff who question what they install — training is the control that decides the outcome.
What is a trojan virus?
Trojan is not one specific malware but a class: any malicious program that relies on deception to get itself executed. The "virus" in the common name is technically imprecise — a true virus self-replicates and spreads file to file; a trojan does not replicate, it waits to be installed. In everyday use, though, "trojan virus" covers the entire family.
What matters for a business is the payload, not the wrapper. The same trojan can deliver:
- Ransomware — files encrypted, payment demanded.
- Spyware and info stealers — passwords, cookies and session tokens harvested and sold.
- Remote Access Trojans (RATs) — a live backdoor the attacker controls, able to watch the screen, move files and pivot into the rest of the network.
- Banking trojans — intercept online banking sessions and steal one-time codes.
- Cryptominers — your electricity silently converted into someone else's cryptocurrency.
How trojans get in
- Phishing attachments. An invoice, résumé, shipping notice or voicemail file that carries the loader — the dominant route in 2026, and the reason phishing simulations exist.
- Fake software downloads. Free converters, cracked applications, "drivers" for unknown devices, and lookalike download portals.
- Malvertising. Search ads that rank above the real vendor's site and serve an infected installer.
- Trojanised updates. A compromised vendor's update channel pushes malware to every customer — rarer, but the highest-impact variant.
- USB drops and infected peripherals. Less common, still real in targeted cases.
Every route has the same precondition: someone has to run it. That is why the trojan family — more than any other — is defeated at the moment of the click.
What a trojan infection costs a business
Because the payload varies, the cost profile varies: ransomware leads to downtime and recovery bills; info stealers lead to account takeover and payment fraud; a RAT leads to weeks of undetected intrusion. Australian businesses have a measured baseline for what this costs: the Australian Signals Directorate logged more than 84,700 cybercrime reports in 2024-25 — one every six minutes — with small business self-reporting an average cost of $56,600 per incident (ASD Annual Cyber Threat Report 2024-25).
The hidden cost runs longer: an info stealer's harvest circulates on criminal marketplaces for months after the infection is cleaned, so credentials have to be treated as compromised even once the device is healthy.
Signs of a trojan infection
- Applications installed that nobody installed, or new entries in startup and scheduled tasks.
- The device connects to unfamiliar servers, or uploads data when idle.
- Security tools disabled or refusing to update.
- Password-reset alerts, unfamiliar sign-ins, or colleagues receiving messages the owner never sent.
- General sluggishness, fans running hot, disk activity when nothing is running.
Any of these on its own proves nothing. The combination, or the same pattern on several devices, justifies an immediate scan and credential rotation.
How to detect and remove a trojan
- Disconnect the device from the network the moment infection is suspected — this stops the payload downloading a second stage or exfiltrating data.
- Scan with updated endpoint protection, in full and offline mode where available.
- Check startup entries, scheduled tasks, browser extensions and installed programs, and remove everything unfamiliar.
- Rotate every credential used on the device from a clean machine, and revoke active sessions.
- Review mailbox rules and MFA registrations — trojan payloads commonly add forwarding rules and re-enrol attacker-controlled MFA.
- For anything uncertain, reimage the device rather than trusting a clean scan on a machine you cannot verify.
How to prevent trojans
- Patch everything — operating systems, browsers, office suites, third-party applications.
- Endpoint protection with behavioural detection on every device.
- Block software installs to admin-approved tools only, and treat "free" downloads from search ads as suspect.
- Enforce MFA everywhere — it does not stop the trojan from installing, but it blunts what the harvested credentials can do.
- Train the click decision. This is the highest-leverage control on the list, because every trojan route ends with a person running the file.
Why training beats the trojan
Technical controls reduce the blast radius; they do not stop the install. What stops it is the ten seconds between "this attachment looks urgent" and "run" — and that hesitation is trainable. Structured programs build the habit of pausing, checking the sender, and reporting the suspicion rather than acting on it.
Cyber Aware's security awareness training runs monthly and pairs lessons with phishing simulations that use the exact lure formats trojans depend on — invoice fraud, fake updates, shipping notifications. Anyone who clicks a simulation is auto-enrolled into remediation the same day, so the people most exposed get more practice, not more blame. Over months, click rates fall and report rates rise — the two behaviours that starve trojans of victims in 2026.
For evidence across Essential 8, SMB1001, ISO 27001 or insurer reviews, a cyber security gap assessment shows which controls you can already demonstrate and which to close first.
FAQ
What is a trojan virus in simple terms? Malware disguised as something useful or urgent, which the user installs themselves. Once inside, it delivers whatever payload it was built to carry — ransomware, spyware, a backdoor or a miner.
What is the difference between a trojan, a virus and a worm? A virus self-replicates by infecting other files; a worm spreads across networks on its own; a trojan does neither — it waits to be run, hidden inside a plausible package.
What is a Remote Access Trojan (RAT)? A trojan that gives the attacker live remote control of the device — screen viewing, file transfer, keyboard control — usually running silently for weeks.
How do trojans get on your phone? Mostly through fake or repackaged apps from third-party stores, phishing links, and malicious attachments opened on mobile. Official app stores filter most, not all.
Can antivirus detect trojans? Known trojans, usually yes. Freshly built loaders evade signatures, which is why behavioural detection, patching and user awareness are layered rather than relying on one tool.
How do I remove a trojan from my computer? Disconnect from the network, run a full offline scan with updated endpoint tools, remove unfamiliar programs and startup entries, and rotate every credential used on the device from a different clean machine. When in doubt, reimage.
One last thing
The single most common trojan delivery in Australian small business is the urgent invoice attachment — fake but plausible, sent to finance or admin staff. If your team has one habit worth building this month, make it this: every invoice that changes bank details, or arrives with unusual urgency, gets verified by phone call to a known number before it is paid. That one habit defeats the trojan and the payment fraud behind it at the same time.
Related guides
- What is spyware? — the credential-harvesting payload most trojans carry.
- Phishing simulations and protection — train the click decision that stops the install.