Malware (malicious software) is software designed to damage, disrupt, or gain unauthorised access to a computer system. Types include:
| Type | How it works | Effect |
|---|---|---|
| Virus | Attaches to legitimate files; spreads when files are shared | Corrupts/deletes data, damages system files |
| Worm | Self-replicates and spreads across networks without user action | Slows network/system, installs other malware |
| Trojan | Disguised as legitimate software | Creates backdoors for hackers, steals data |
| Ransomware | Encrypts victim's files | Demands payment (ransom) for decryption key |
| Spyware | Runs secretly in background | Monitors activity, steals passwords/data |
| Adware | Displays unwanted adverts | Annoyance; may slow system; can track browsing |
Social engineering manipulates people rather than exploiting technical weaknesses. Common attacks:
Fraudulent emails, messages, or websites that appear legitimate to trick users into revealing passwords, bank details, or personal information. Variants include:
Creating a fabricated scenario (pretext) to gain someone's trust and extract sensitive information — e.g. pretending to be IT support.
A DoS (Denial of Service) attack floods a server with so many requests that it cannot respond to legitimate users, effectively taking it offline.
A DDoS (Distributed Denial of Service) attack uses thousands of compromised computers (a botnet) to launch the attack simultaneously, making it much harder to block.
An attacker secretly intercepts and potentially alters communication between two parties who believe they are communicating directly with each other. Common on unsecured public Wi-Fi.
Attackers insert malicious SQL code into a web form or URL to manipulate a database — potentially reading, modifying, or deleting data, or bypassing login authentication.
Systematically trying every possible combination of characters until the correct password is found. Automated tools can try millions of combinations per second — making short, simple passwords very vulnerable.
Directly observing someone's screen or keyboard to obtain passwords, PINs, or other sensitive information — e.g. watching someone type their PIN at an ATM or looking over their shoulder in a café.
Redirecting a user to a fake website without their knowledge, even when they type the correct web address. Achieved by poisoning DNS records or modifying the device's hosts file. Unlike phishing, the user does not need to click a fraudulent link.
Leaving infected USB drives in public places (e.g. car parks, offices) hoping that a curious person will plug one in. When connected, malware installs automatically. Also called a "baiting" attack.
Attackers actively search for known vulnerabilities in software that has not been updated. Once a vulnerability is public knowledge, systems that have not applied the patch become easy targets. This is why regular software updates and patch management are critical.