A trojan is malware disguised as something legitimate: a cracked app, an invoice attachment, a fake update prompt. Unlike a virus, it cannot spread on its own. It relies on you opening the door.
Once it runs, it can steal credentials, install a backdoor, or drop further payloads without ever announcing itself. That quiet behaviour is exactly what makes it dangerous.
Why trojans are so hard to spot
A trojan’s entire design is deception. It arrives wrapped in something you already trust, like a PDF invoice or a game installer, so your guard is down before it even runs.
Many variants also disable or blind security tools after execution, so the infection can sit quietly for weeks. This overlaps with the tactics covered in our guide on the different types of malware attacks, where trojans sit alongside worms and ransomware as distinct threat categories.
Common trojan behaviours once installed
Banking trojans watch for login pages and inject fake fields to capture credentials. Remote access trojans (RATs) give an attacker a live connection into your machine, letting them browse files or activate a webcam.
Downloader trojans exist purely to fetch a second payload, often ransomware or a spyware kit, once the initial infection is confirmed to be undetected.
How trojans usually get in
Phishing emails with attachments remain the top delivery method, followed by cracked software and fake browser extensions. Malvertising, where a legitimate-looking ad redirects to a malicious download, is also common on lower-quality sites.
If you want the full breakdown of delivery mechanisms across malware families, our types of malware explained guide covers each one in detail.
Removing a trojan safely
Disconnect the machine from the network first, so any RAT or backdoor component loses its connection to the attacker. Boot into safe mode and run a full scan with reputable, updated antivirus or anti-malware software rather than a random tool you just downloaded.
Change your passwords from a separate, clean device, since credentials typed on the infected machine may already be compromised. If the trojan modified system files or you cannot confirm full removal, a clean OS reinstall is the safest route.
Businesses handling sensitive records should also revisit their broader cloud data security posture, since a single infected endpoint can be the entry point into much larger systems.
Preventing the next infection
Keep your OS and applications patched, since trojans often exploit known vulnerabilities in outdated software. Avoid cracked software and unofficial app stores entirely, no matter how convenient they seem.
Treat unexpected attachments and login prompts with suspicion, even when they appear to come from someone you know. Attackers regularly spoof trusted senders to lower your guard.
Frequently asked questions
Can a trojan spread on its own like a virus?
No. A trojan needs you to run it. It cannot self-replicate or spread across a network the way a worm does, which is the key technical difference between the two.
Does antivirus software catch every trojan?
Not always. Newer or heavily obfuscated trojans can slip past signature-based detection for a period. Keeping software updated and using behaviour-based detection improves your odds significantly.
Is a factory reset enough to remove a trojan?
Usually, yes, since it wipes the infected system entirely. The exception is firmware-level infections, which are rare but survive a standard OS reset and require specialist tools to clear.
