# Types of malware, explained > Ransomware, infostealers, RATs, loaders, wipers and rootkits: what each kind of malware actually does, and how it gets onto a machine. Source: https://www.malware.com.au/types-of-malware/ Last updated: 2026-08-24 --- "Malware" is just the umbrella term for software written to do something you did not authorise. The categories below describe _what it does once it runs_, and that is the useful distinction, because it determines what you have actually lost. One thing to hold onto: **these categories overlap constantly**. A single intrusion routinely involves a loader that fetches an infostealer, whose harvested credentials are sold to a group that deploys ransomware three months later. Treating a "minor" infostealer alert as unrelated to the ransomware that follows is one of the more expensive mistakes in security. This page is the read-through. If you already know the categories and just want to look one up, the [malware family reference](/malware-families/) has the same ground in a fixed per-family shape, with current examples and defences. ## Ransomware Encrypts your files and demands payment for the decryption key. Modern campaigns almost always **steal the data first** and threaten to publish it, so restoring from backup solves availability, but does nothing about disclosure. That distinction matters more than it sounds. If data left your network, you may have a notifiable data breach whether or not you ever paid, and whether or not you recovered cleanly. The OAIC administers the [Notifiable Data Breaches scheme](https://www.oaic.gov.au/privacy/notifiable-data-breaches) and, if a payment was made, [ransomware payment reporting](https://www.cyber.gov.au/report). More detail: [how a ransomware attack unfolds](/ransomware/). ## Infostealers Small, fast, and increasingly the most consequential category. An infostealer runs once, sweeps the machine for anything valuable, sends it out, and often deletes itself. What it takes: - **Browser-saved passwords** and autofill data - **Session cookies**: the important one, because a stolen session cookie lets an attacker resume your logged-in session _without_ your password and _without_ triggering MFA - Cryptocurrency wallets, VPN and email client configs, SSH keys Because session theft bypasses MFA, "we have MFA everywhere" is not an answer to infostealers. Shortening session lifetimes and binding sessions to a device is. They arrive through cracked software, fake installers promoted via search ads, malicious browser extensions, and "fix your video driver" style lures. ## Remote access trojans (RATs) Give an attacker interactive, hands-on-keyboard control of the machine: file browsing, keystroke logging, screen capture, webcam and microphone access, and a foothold to move deeper into the network. A RAT is not a smash-and-grab. It is presence. The defining risk is dwell time: an operator who has been quietly watching for weeks understands your payment approvals, your org chart and your backup schedule. ## Loaders and droppers Deliberately boring software whose only job is to establish a foothold and then fetch whatever the operator wants to run next. Loaders are sold as a service, one crew specialises in getting in, then rents that access out. This is why triage matters: a loader detection looks trivial and is not. It means someone has a door open and is deciding what to sell it for. ## Wipers Look like ransomware but are designed purely to destroy. Sometimes there is a ransom note as misdirection; there is no key. Wipers are typically used for sabotage or to destroy evidence rather than for profit, and offline, restore-tested backups are the only meaningful defence. ## Rootkits and bootkits Compromise the operating system, firmware or boot process so the malware runs before, or beneath, the tools looking for it. They are relatively rare, hard to build, and hard to detect from within the running system. A machine suspected of a firmware-level compromise should be treated as unrecoverable rather than cleaned. ## Cryptominers Quietly consume your CPU or GPU to mine cryptocurrency for someone else. Financially minor, but treat every miner as an incident, not a nuisance: it proves someone could execute arbitrary code on that host. The next payload can be anything. ## Adware and stalkerware Adware injects advertising and hijacks search. Mostly a nuisance, though it often ships alongside genuine credential theft. **Stalkerware** is different and worth naming separately: commercial apps installed on a victim's phone by someone with physical access, usually a partner or family member, to monitor messages and location. It is a safety problem before it is a technical one. In Australia, [1800RESPECT](https://www.1800respect.org.au) (1800 737 732) and [IDCARE](https://www.idcare.org) (1800 595 160) can help, and removing the app can escalate risk, so plan before acting. ## How malware actually gets in The delivery routes have shifted. In rough order of what currently matters: 1. **Stolen credentials with no phishing-resistant MFA**: the quietest way in, and increasingly the most common. No malware needed to start. 2. **Unpatched internet-facing systems**: VPN appliances, firewalls, file transfer products. Exploited within days of a patch being published, sometimes hours. 3. **Phishing and malicious attachments**: still effective, though macro blocking has pushed attackers toward container files and shortcut files. 4. **Malicious search ads and fake installers**: the main infostealer route. Someone searches for a legitimate tool and clicks the ad above the real result. 5. **Supply chain**: compromised software updates, or a managed service provider's access being abused to reach every one of its clients at once. Notice that the first two need no user mistake at all. Awareness training is worth doing, but it cannot address the majority of this list. That is what [the Essential Eight](/essential-eight/) is for. ## What actually reduces the risk In effort-to-benefit order: - **Phishing-resistant MFA** on email, VPN and admin accounts. [Not all MFA counts](/multi-factor-authentication/). - **Patch internet-facing systems fast.** Days, not quarters. - **Offline, restore-tested backups** that a compromised admin account cannot reach. - **Application control** on servers and high-value workstations. - **Remove local admin rights** from day-to-day accounts. - **Shorten session lifetimes** so stolen cookies expire before they are used. If you think you are already infected, start with [reporting and the first do first](https://www.cyber.gov.au/report). Want to check what stuck? [Take the quiz](/quiz/): six questions, instant score, nothing stored. ## Common questions ### What is the most common type of malware? By volume of infections, infostealers are now the most common thing an individual encounters, because stolen credentials are cheap to harvest and easy to sell. By financial damage to organisations, ransomware remains the costliest. ### Is a virus the same thing as malware? No. Malware is the umbrella term for any malicious software. A virus is one specific kind: code that attaches itself to a legitimate file and spreads when that file runs. True viruses are now rare; most modern malware does not self-replicate at all. ### Can malware infect a phone? Yes, though the routes differ. On mobile the common vectors are malicious apps from outside the official stores, sideloaded apps, and attacker-installed device management profiles, rather than the email attachments that dominate on desktop. ## Primary sources - [ASD: Malicious software (malware)](https://www.cyber.gov.au/threats/types-threats/malware) - [MITRE ATT&CK: Enterprise techniques](https://attack.mitre.org/techniques/enterprise/) --- General information only, not legal advice. Whether an obligation applies turns on facts about your organisation and the incident. Check the primary sources above and obtain legal advice. Emergency: Australian Cyber Security Hotline 1300 CYBER1 (1300 292 371), 24/7.