Malware is any software deliberately built to damage, disrupt, or secretly watch a computer system — ransomware, spyware, trojans, keyloggers, worms, and everything in between. In practice, the story at most small businesses is the same: a staff member opens something that looks like a routine invoice, a small program installs quietly, and that program either steals passwords or waits for instructions from the attacker. Verizon's 2025 Data Breach Investigations Report finds the human element involved in roughly six in ten breaches (Verizon 2025 DBIR) — and malware reaches a system through exactly that human gap. This guide covers what malware is, the types a small business actually encounters in 2026, the warning signs, and what to do in the first hour after a suspected infection.
TL;DR
- Malware is any malicious software: it damages, disrupts, or spies on your systems.
- Almost every infection starts with a staff action — an attachment, a link, a fake installer.
- The types that matter for small business: ransomware, spyware, keyloggers, trojans, worms, botnets.
- First hour: disconnect the device, change passwords from a clean machine, report the incident.
- Antivirus helps; trained staff decide the outcome — most infections begin with one click on a lookalike that phishing simulation training rehearses.
What is malware, exactly?
Malware is short for malicious software: any program written to harm a computer, its data, or the people who use it, without the owner's informed consent. The category is broad on purpose. A virus is one kind of malware; so is the keylogger that quietly records every password typed, and the worm that copies itself across your network overnight. What unites them is intent — ordinary software fails by accident, malware fails you on purpose.
For business owners the distinction that matters is not the taxonomy but the job each type does. Some malware destroys (ransomware, destructive wipers). Some malware steals (spyware, keyloggers, infostealers). Some malware enlists your computer in someone else's operation (botnets, cryptominers). Most real incidents involve at least two of these working together: a stolen password today becomes a ransom note next week.
The types a small business actually encounters
- Ransomware. Encrypts your files and demands payment for the key. Almost always arrives through a phishing email or a stolen remote-access password.
- Spyware and infostealers. Sit quietly and exfiltrate data: saved browser passwords, client records, email archives.
- Keyloggers. Record keystrokes to capture banking logins and security codes as you type them.
- Trojans. Disguise themselves as legitimate software — a fake installer, a dodgy invoice viewer — to get past initial suspicion.
- Worms. Copy themselves across the network without anyone clicking, which is why one infected laptop can reach a whole office.
- Botnets. Enrol the infected machine in a rented attack network, slowing it down while it helps attack someone else.
- Adware and cryptominers. Lower stakes but a reliable symptom: pop-ups that return, or machines running hot for no reason.
How malware gets onto a work device
The delivery methods barely change year to year, and in 2026 they are still mostly mundane:
- Phishing attachments. An invoice, a shipping notice, a resume. One click on a weaponised file is enough.
- Malicious links. A link that leads to a fake login page or triggers a silent download.
- Fake installers. Search ads and download sites that serve trojanised versions of popular tools.
- Removable media. USB drives and borrowed charging cables — rarer now, but real in logistics and field services.
- Supply-chain compromise. A trusted vendor or software update that ships infected.
- Unpatched vulnerabilities. Malware that needs no click at all — it walks through a known hole in an out-of-date system.
Notice the pattern: five of the six routes involve a person doing something ordinary. That is why a cyber security gap assessment almost always surfaces the same finding in small businesses — the technical controls exist, but nobody has addressed the decision-making at the moment of the click.
Malware vs phishing vs hacking
| What it is | What it needs | |
|---|---|---|
| Malware | Malicious software on your systems | A delivery event: an attachment, installer or unpatched hole |
| Phishing | A message that tricks a person | An inbox and a moment of inattention |
| Hacking | Direct exploitation of a system | An exposed, unpatched service |
The categories overlap in practice: phishing is the most common delivery method for malware, and malware is the most common payload a successful phishing email leaves behind. They are one attack seen from three angles.
The warning signs of an infection
- Computers suddenly slow, fans running hard, or storage filling for no reason.
- Browser homepages or search engines that change themselves.
- Pop-ups that return after you close them.
- Colleagues receiving emails you never sent.
- Security tools that have been switched off or uninstalled — a deliberate attacker disables them first.
- Files with unfamiliar extensions, or folders full of ransom notes.
None of these is proof, and modern malware often shows no symptoms at all while it works. Treat any unexplained change as urgent, not cosmetic.
What to do in the first hour
- Disconnect, do not shut down. Unplug the network cable and switch off Wi-Fi. Shutting down can destroy evidence still held in memory.
- Change passwords from a different, clean device — starting with email, banking and remote access. Malware steals credentials first; assume they are already stolen.
- Report it. In Australia, ReportCyber coordinates with police and banks, and your insurer likely requires the report.
- Do not pay ransom demands or click unlock prompts — escalate to your IT provider or an incident-response specialist first.
- Preserve evidence. Keep the infected machine powered down and untouched for the responder.
Why malware keeps beating technical defences
Antivirus, firewalls and multi-factor authentication all work — and all of them assume the click never happens. Attackers know this, which is why the effort has shifted: rather than fight the technical controls, the malware arrives through a person making an ordinary decision under time pressure. A finance officer who checks new bank details by replying to the email. A manager who re-enters their email password on a login page that looked right.
This is why security awareness training is not a compliance checkbox but the control that decides outcomes. Repeated, measurable training — short monthly modules, real simulations, one click tested rather than assumed — moves the decision quality of the whole team, not just the IT contact. And because the goal is evidence rather than hope, human risk reporting shows directors exactly which teams are clicking, which modules land, and where the next incident is most likely to come from.
FAQ
What is malware in simple terms? Software written to damage, disrupt or spy on a computer system without the owner's consent. It includes viruses, ransomware, spyware, trojans and more — virus is just one kind of malware.
What is the difference between malware and a virus? A virus is one type of malware — a program that copies itself into other files. Malware is the whole category, including ransomware, spyware, keyloggers and trojans that never self-replicate.
How does malware get past antivirus software? New variants are changed faster than detection databases update, and much of it arrives with stolen passwords instead of files — antivirus sees nothing to scan. Layered controls plus trained staff close that gap.
Can malware infect phones and tablets? Yes. Malicious apps, fake app stores and text-message links all deliver mobile malware, especially on Android. Business phones need the same patching and training discipline as laptops.
Does malware always show symptoms? No. The most expensive malware — keyloggers and infostealers — is designed to be invisible. Assume a quiet infection is possible after any suspicious click and verify rather than hope.
One last thing
Malware is not a hacking story; it is a habits story. In 2026 the fastest route onto a business network is still one staff member doing one ordinary thing. The organisations that stay clean are the ones that rehearse: backups tested, multi-factor authentication switched on, and a team that reports the suspicious email instead of opening the attachment.