What malware is, and how it gets onto a computer

Malware is short for malicious software: any program written to do something its victim did not agree to. The US National Institute of Standards and Technology (NIST) defines it as software or firmware intended to perform an unauthorised process that will have an adverse impact on the confidentiality, integrity or availability of a system. That definition is useful because it describes the harm, not the technique. A program that steals your passwords, one that locks your files, and one that quietly turns your computer into part of someone else’s network are all malware, even though they look nothing alike on the inside.

The main families, by what they want

Security people sort malware into families according to how it spreads and what it is after. The names overlap, and a single piece of real-world malware often combines several of them, but the vocabulary helps you read news and advice with a clearer eye.

How it actually gets in

Films show attackers typing furiously to break through defences. Real infections are usually far more ordinary. The MITRE ATT&CK knowledge base, which catalogues techniques seen in real attacks, lists “user execution” as a technique of its own: the attacker’s goal is to get you to open or run something. Most infections on personal computers start that way, with a person making a decision that looked reasonable at the time.

• A download from the wrong place: a cracked version of paid software, a “free” converter, a fake video player that a streaming site claims you need.
• A fake update: a pop-up on a web page claiming your browser or Flash is out of date (Flash was retired years ago, which alone makes the message a lie).
• An attachment or link in an email or message that pretends to come from a delivery company, a bank, a colleague or a government office.
• A search advert for a popular app that leads to a lookalike site hosting a modified installer.
• A removable drive: a USB stick left in a car park, or a colleague’s drive that was infected on another computer.
• An unpatched vulnerability: a flaw in software you already run, used to get in without you doing anything. Rarer for home users, but the reason updates matter.

Why Macs are targets too

The idea that Macs cannot get viruses was never quite true, and it is less true every year. As Macs became common in offices, among creators and among people who hold cryptocurrency, criminals followed the money. Apple itself documents several layers of defence precisely because the threat is real: Gatekeeper checks that downloaded apps come from identified developers and have been notarized, XProtect scans for known malicious software, and runtime protections limit what apps can do. Those layers work well against known threats and careless attackers. They are much weaker against the most common trick of all, which is persuading the user to override them: many Mac infections begin with instructions telling you to right-click, choose Open, or type your password to “allow” an installer.

What malware needs once it is inside

Once installed, most malware needs three things. It needs to stay: to survive a restart, it usually registers itself to launch automatically, for example as a login item or a background launch agent. It needs permissions: access to your files, your keychain, your screen or your camera. And, in almost every case, it needs to talk to the internet: to receive instructions, download more components or send stolen data away. That last need is an opportunity for defenders, because a network connection is something you can see and control even when you cannot tell what a program is doing on the disk.

This is where a per-app firewall such as FireAI fits. FireAI is not an antivirus and does not remove malicious software, but it asks before an unknown app connects for the first time, shows every connection on the world map, and can block an app or a destination. A new program that suddenly tries to reach a server you have never heard of is exactly the kind of moment worth stopping and looking at.

Signs that something may be wrong

• An app, login item or browser extension you do not remember installing.
• Your browser’s search engine or home page changed on its own.
• Unexpected prompts asking for your password, especially right after installing something.
• Fans running and battery draining while the computer seems idle.
• Accounts showing logins from places you have never been, or friends receiving messages you did not send.
• An app you do not recognise connecting to the internet over and over.

None of these proves an infection on its own, and several have innocent explanations. Treat them as reasons to look closer: check Login Items in System Settings, review recently installed apps, run a reputable scanner if you are worried, and change passwords from a device you trust if you think credentials were exposed.