Malware, short for malicious software, is any program written to do something the owner of a device or website did not agree to: steal data, lock files for ransom, spy on activity, send spam or recruit the machine into an attack. It can arrive through an email attachment, a fake download, an unpatched website plugin or a compromised password.
The main types and what each one does
- Virus and worm: a virus attaches to files and spreads when they run; a worm copies itself across networks without help.
- Trojan: disguised as something useful, like a cracked app or an invoice, and opens a back door once launched.
- Ransomware: encrypts files and demands payment for the key. WannaCry in 2017 spread through an unpatched Windows flaw and hit hospitals in the UK's NHS.
- Spyware and infostealers: record keystrokes or steal saved passwords and browser session cookies, which can let attackers skip 2FA.
- Botnet agents: quietly enlist the device for spam or DDoS attacks.
How malware gets onto websites
Website infections are a separate problem from infected laptops. The usual route is an outdated CMS plugin or theme with a known hole, or a stolen admin password. Once in, attackers add hidden spam links, redirect mobile visitors to scam pages, or inject a card skimmer into the checkout. The Magecart groups became known for skimming card details from checkout pages, including on the British Airways site in 2018.
A florist's site that started redirecting
A florist hears from customers that the site sends phones to a prize-draw page. Desktop visits look fine, which is typical: the injected script targets mobile users and hides from logged-in admins. Google flags the site in Search Console's Security Issues report and browsers start showing a red warning. The fix is restoring clean files from a backup, updating every plugin, changing all admin and hosting passwords, then requesting a review in Search Console.
What a small business should actually do
On devices: keep the operating system updated, leave built-in protection like Microsoft Defender on, and keep offline or versioned backups so ransomware cannot hold you hostage. On the website: keep the CMS and plugins updated or use a platform that patches for you, remove plugins you do not use, and check Google Search Console for security alerts.
Mistakes that invite malware
- "Nulled" premium themes or plugins downloaded free from unofficial sites; many ship with back doors.
- Backups stored on the same server that gets infected or encrypted.
- Deleting the visible spam but not the entry point, so the site is reinfected within days.
- Sharing one admin login between staff and contractors.
Related terms
- Firewall: blocks some delivery routes, not all.
- Plugin: the most common way into a CMS site.
- DDoS: often powered by malware-infected devices.
- Google Search Console: reports hacked content Google finds.