Malware
What each kind actually does once it runs, and how it gets onto a machine. Organised by behaviour rather than by whichever campaign is in the news, because names go stale within months and behaviour does not.
New to this? Start with the explainer. If you already know the categories and want to look one up, go straight to the reference.
The categories overlap
Real incidents rarely stay in one box. A loader gets in and fetches an infostealer; the credentials it takes are sold on; months later a different crew uses them to deploy ransomware. Three categories, one incident, and the first alert looked minor enough to close.
That is why the categories here describe behaviour rather than naming campaigns. What a thing does once it runs determines what you have actually lost and which control would have stopped it, and behaviour is stable for years while names change within months.
Types of malware, explained
Ransomware, infostealers, RATs, loaders, wipers and rootkits: what each kind of malware actually does, and how it gets onto a machine.
Ransomware: how an attack unfolds
How a ransomware attack progresses from first access to extortion, why paying rarely ends it, and what to do in the first 24 hours.
Malware family reference
One entry per family in a fixed shape, for looking something up: status, current examples, how it spreads and the defences that work.
Test yourself: the malware quiz
Six questions with the reasoning shown for each answer. Instant score, nothing stored, no sign-up.
Not sure any of this applies to you?
Most people do not need to know the categories at all. If you just want to not get caught, read how to avoid malware, which is the short version for home and for work, with no jargon in it.