Malware
32 articles
Malware is any software built to harm, spy on, or take control of a system. These guides cover malware analysis fundamentals, static and dynamic techniques, sandboxing, and the indicators of compromise and YARA rules defenders use to detect and classify threats.
Attacker File Formats: How File Types Get Weaponised
A defensive explainer on how attackers weaponise file formats: scripts, shortcuts, disk images, macro docs, installers, images and archives.
Command and Control: Beaconing, Channels & Detection
How C2 works: beaconing, HTTP, DNS and social-media channels, redirectors, and the traffic patterns defenders use to find implants on a network.
LOLBins Explained: Living Off the Land With Windows Binaries
A defensive reference to Living Off the Land Binaries: why signed Microsoft tools like rundll32, mshta and certutil get abused, and how to detect the misuse.
Malware Obfuscation: Packing, Encoding & Evasion
How malware hides from analysis with packing, encoding and encryption, and the behavioural and unpacking methods defenders use to see through it.
Malware Persistence Techniques: How Malware Survives Reboot
How malware survives a reboot using autostart, services, scheduled tasks, and registry keys, plus the process-chain and event-log signals that hunt each one.
Malware Sandbox Evasion: How Samples Dodge Analysis
How malware spots an analysis sandbox and stalls, sleeps, or hides, plus the detection and defensive countermeasures that beat evasion at scale.
Ransomware-as-a-Service Explained: The Affiliate Model
RaaS turns ransomware into a rented product with affiliates and double extortion. How the business works, who plays each role, and where to focus defense.
What Is a Backdoor? Hidden Access and Web Shells Explained
A backdoor is a hidden way back into a system that skips normal authentication. How backdoors and web shells work, how they persist, and how to detect them.
What Is a Banking Trojan? Overlay & Web-Inject Fraud
Banking trojans steal money by faking login screens and rewriting bank pages mid-session. How overlays and web injects work, plus mobile defense.
What Is a Bootkit? Persistence Below the Operating System
A bootkit infects the boot process so it loads before the OS and survives reinstalls. How boot and UEFI-level malware works, and how Secure Boot defends.
What Is a Botnet? Command Structures and Takedowns Explained
A botnet is a network of hijacked devices controlled at scale. How command structures work, what botnets do, and how sinkholing takes them down.
What Is a Computer Worm? Self-Spreading Malware Explained
A computer worm copies itself across networks with no human help. How worms spread so fast, and how patching and segmentation stop them.
What Is a Cryptojacker? Unauthorized Mining Malware
Cryptojackers steal your compute to mine cryptocurrency for someone else. Browser vs host mining, spotting it by resource use, and how to defend.
Loaders and Droppers Explained: First-Stage Malware Delivery
Loaders and droppers are the first-stage malware that plants the real payload. How staged delivery works, how the two differ, and how to detect the hand-off.
What Is a Logic Bomb? Trigger-Based Malicious Code
A logic bomb is code that stays dormant until a trigger fires: a date, an event, a missing record. How they work and how to catch them.
What Is a RAT? Remote Access Trojans Explained
A remote access trojan gives an attacker hands-on control of your machine: screen, files, webcam, keystrokes. How RATs work, spread, and how to detect them.
What Is a Rootkit? Kernel and User-Mode Stealth Explained
A rootkit hides other malware by tampering with the operating system itself. How kernel and user-mode rootkits work, the hiding tricks, and how to detect them.
What Is a Trojan Horse? Malware in Disguise Explained
A trojan is malware disguised as something you want to run. How trojans use social engineering to get executed, the payloads they carry, and how to defend.
What Is a Wiper? Destructive Malware Disguised as Ransomware
Wipers destroy data with no way to restore it, often disguised as ransomware. How they differ, attacker motives, and how backups make you resilient.
What Is Adware? Unwanted Ads, PUPs, and Bundling
Adware floods your device with ads, hijacks your browser, and tracks you. How it sneaks in through bundling, why it counts as a PUP, and how to clean it out.
What Is an Infostealer? The Malware Behind Most Breaches
Infostealers grab saved passwords, session cookies and crypto wallets in seconds, then sell the logs. How they work, why cookies defeat MFA, and how to defend.
What Is Cobalt Strike? The Red-Team Tool Criminals Adopted
A defensive explainer on Cobalt Strike: what the framework is, how Beacon works, why criminals abuse cracked copies, and how defenders detect it.
What Is Fileless Malware? Memory-Only Attacks Explained
Fileless malware runs in memory and abuses trusted system tools, so disk scanning misses it. How it works, why signatures fail, and how to detect it.
What Is Metasploit? The Exploitation Framework, Explained
A beginner-friendly defensive explainer on Metasploit: what the exploitation framework is, its legitimate and criminal uses, and how to detect it.
What Is Mimikatz? Credential Dumping and How to Stop It
A defensive explainer on Mimikatz: the credential-dumping tool, how it targets LSASS memory, the attacks it enables, and how Credential Guard defends.
What Is Polymorphic Malware? Why Signatures Fail
Polymorphic malware rewrites itself on every copy so no two samples share a signature. Polymorphic vs metamorphic, why hashes fail, and behavioural defence.
What Is Scareware? Fake Alerts, Fake Antivirus, Real Damage
Scareware uses fake virus warnings to panic you into paying or calling a scammer. How the scam works, how it overlaps tech-support fraud, and how to defend.
What Is Spyware? Surveillance Malware and Stalkerware
Spyware is malware built to watch you: keystrokes, screens, location, and messages. How it works, its overlap with stalkerware, and how to detect and remove it.
Best Antivirus Software in 2026: Tested, Ranked, No Fluff
We ranked Bitdefender, Norton, Malwarebytes, ESET, and TotalAV against lab data, and explain when free Microsoft Defender is genuinely enough.
Introduction to Malware Analysis
A practical guide to static and dynamic malware analysis, covering PE inspection, sandboxing, strings extraction, and the tools analysts actually use.
Keyloggers: How They Work and How to Detect Them
Keyloggers silently record every keystroke you type. Learn how software and hardware keyloggers work, how to detect them, and how to protect yourself.
Zero-Day Vulnerabilities: What They Are and Why They Matter
Zero-days are the most dangerous class of vulnerability. How they're discovered, traded and exploited, and what you can actually do to protect against them.