A trojan disguises itself as legitimate software. The name comes from the Greek myth of the wooden horse. Users install it willingly because it looks useful. A free game, a system optimizer, a cracked version of paid software. Once installed, the trojan does something else entirely. It may open a backdoor, steal credentials, download additional malware, or join the device to a botnet. The user never sees it coming because they invited it in.

Trojans are one of the oldest malware categories and still one of the most effective. They exploit trust and convenience. Pirated software is a common delivery method. So are fake antivirus tools, malicious browser extensions, and phishing attachments. Remote access trojans, or RATs, are a common subtype. They give the attacker full control of the machine: file access, screen viewing, keyboard input, and camera. Some RATs are sold commercially as surveillance tools. Others are built by criminal groups and rented to affiliates. Detection is difficult because the trojan may run as a legitimate process. Antivirus tools catch known signatures. Behavioral analysis catches unusual activity. Neither is perfect. The best defense is not installing software from untrusted sources. That sounds simple. People do it anyway.

Common trojan types

• Remote access trojan — gives the attacker control
• Banking trojan — steals financial credentials
• Downloader — fetches additional malware
• Backdoor trojan — opens persistent access
• DDoS trojan — joins the device to a botnet

A trojan is a lie. The software promises one thing and does another. The user is the delivery mechanism.