Trojan horse (malware)
Also known as: trojan, trojan horse, trojan malware, trojan virus
A trojan horse, or trojan, is malicious software disguised as something legitimate or useful, such as a free game, a software crack, a video player, or an invoice attachment.
Once the victim runs it, the trojan can steal data, download more malware, or give attackers remote control. Unlike viruses or worms, trojans don't spread on their own; they depend on persuading people to open them, which makes careful downloading the main defence.
Trojan horse (malware), explained at three levels
At home
A trojan is named after the wooden horse the Greeks used to sneak soldiers into Troy. It looks like a gift, such as a free game, a video converter, or a document, and it may even work as promised. But when you open it, you also run the hidden malware inside, which can steal your passwords or let a criminal control your computer.
At work
A trojan is malware disguised as something legitimate, such as an invoice attachment, a software update, or a free tool. It doesn't break in on its own; an employee runs it, giving it that person's access. It can then steal data, install more malware, or open a backdoor for attackers. Businesses defend by filtering attachments and restricting who can install software.
At home
A trojan relies on you to install it. It arrives looking like something you want, such as a free game, a video player or a document, and it may even work as advertised. When you run it, you give it the same permissions you have. In the background it carries out its real job: stealing saved passwords, recording your screen, or opening a hidden connection so a criminal can control the computer remotely.
At work
Trojans are classified by payload. Remote access trojans give full control, banking trojans inject fake forms into bank sites, droppers and loaders install other malware, and backdoors keep a way back in. Common delivery methods include email attachments, malicious ads leading to fake download pages, and cracked software. Many use legitimate cloud services for command and control so their traffic blends in. Defences include attachment filtering, application control, blocking Office macros from the internet, and EDR.
At home
A trojan does not need to break through any security hole, because you open the door for it. That is why pirated software, 'free' versions of paid apps and game cheats are such common carriers: the people sharing them can add anything they like, and you have no way to check. Antivirus may catch known trojans but not new ones. In my view, nothing you download for free from an unofficial source is worth the risk of handing over your accounts.
At work
Modern trojans evade defences by abusing stolen or fraudulently obtained code-signing certificates, side-loading malicious DLLs through legitimate signed programs, and buying search engine ads that impersonate popular software. Loaders such as those used by initial access brokers often hand off to ransomware within hours. Application allow-listing, blocking execution from user-writable folders, restricting admin rights, and ad-blocking or DNS filtering for software downloads remove most of the opportunities they rely on.
Real-world examples
At home
Sophie searched for a free video converter and installed the first result. It worked, but it was a trojan that stole her saved browser passwords.
At work
Carlos is IT manager at a Laval logistics firm. A staff member opened a fake 'shipping invoice' attachment that was a trojan, and EDR blocked it before it could connect to attackers.
How it compares
| feature | Trojan horse (malware) | Computer worm |
|---|---|---|
| Spreads by itself | No, needs the user to run it | Yes |
| Disguise | Pretends to be useful | Usually none |
| Main trick | Deceiving people | Exploiting vulnerabilities |
| Key defence | Careful downloads, app control | Patching |
Trojans trick people. Worms exploit machines.
For analysts
I'd restrict staff from installing software without approval. It's one of the most effective ways to stop trojans, and it reduces support headaches too.
History & origin
The name comes from the Greek legend of soldiers hidden inside a wooden horse to enter the city of Troy. Computer scientists used the term for disguised malicious programs in the early 1970s, and Ken Thompson's 1984 lecture 'Reflections on Trusting Trust' described a famous theoretical trojan hidden in a compiler. Remote access trojans such as Back Orifice in 1998 and SubSeven let attackers control PCs. The Zeus banking trojan, first seen in 2007, stole millions of dollars from bank accounts, and Emotet began as a banking trojan in 2014 before becoming a major malware delivery service. Mobile trojans hidden in fake apps followed the shift to smartphones. In my view, trojans prove that the oldest trick, a gift that isn't what it seems, still works best.