What Is a Trojan Horse? Malware in Disguise Explained

The name comes from the oldest trick in the book. The Greeks could not break through the walls of Troy, so they built a wooden horse, hid soldiers inside, and let the defenders wheel it in themselves. The malware version works exactly the same way. The attacker cannot easily break into your machine, so they wrap their code in something you actually want, a game, an installer, an invoice, a cracked app, and let you carry it through the door yourself.

That is the essence of a trojan. It does not force its way in. It gets invited. And because the whole attack turns on a person choosing to run a file, a trojan is a social problem wearing a technical costume.

Trojan is a delivery method, not a payload

The most useful thing to understand about trojans is that the word describes how malware arrives, not what it does once it runs. This trips people up, because families get labelled "a trojan" as if that were their function. It is not. The trojan is the disguise; the payload is the point.

The same trojan wrapper can carry almost anything:

• An infostealer that grabs passwords and session cookies and leaves. See What Is an Infostealer.
• A remote access trojan that hands an operator hands-on control. See What Is a RAT.
• Ransomware that encrypts everything and demands payment.
• A backdoor that quietly preserves re-entry for later.
• A downloader whose only job is to fetch and run the real payload.

This is why defending the delivery is so efficient. Stop the trojan from executing and you stop whatever it was carrying, whichever family that happens to be this week.

Why it works: social engineering, not exploits

A trojan usually needs no software vulnerability. There is nothing to patch that would have prevented it, because the mechanism is a human decision. The attacker's craft goes entirely into making a malicious file look safe and desirable enough that you double-click it.

The disguise leans on a handful of reliable levers:

• Familiarity. A filename, icon, or brand you recognise and trust.
• Desire. Something you want and might not get legitimately: paid software for free, a game cheat, a leaked document.
• Urgency and authority. An invoice that is overdue, a message that looks like it is from IT or a delivery company.
• Plausibility. A file that matches what you were expecting to receive.

Because the target is a person, this behaviour maps to User Execution (T1204) on MITRE ATT&CK, a technique defined by the victim running the file, and it usually rides in on Phishing (T1566). For the wider picture of how these lures are built, see What Is Phishing.

The disguises trojans wear

Trojans reach people through predictable channels, each with its own flavour of disguise:

Channel	Typical disguise
Phishing email	Invoice, receipt, shipping notice, or resume attachment
Cracked and pirated software	A paid application or game, free
Fake updates and installers	A browser, codec, or plugin update prompt
Malvertising and poisoned search	A top result for a popular download
Messaging and social media	A shared file, cheat, or tool from a "friend"
Paste-a-command lures	A fake CAPTCHA or fix that asks you to run a command

Underneath these channels, the actual malicious file is almost always one of a small set of abused formats: a script, an archive, a disk image, a document with active content, or a rogue installer. The disguise is on the outside; the format is what does the work. Our File-Format Abuse Atlas catalogues those formats and how to recognise them, which is the practical choke point where a trojan is stopped before it runs.

The trojan lifecycle

A trojan attack follows a consistent shape:

1. Lure. The attacker crafts the disguise and delivers it through one of the channels above.
2. Execution. The victim runs the file, believing it is safe. This is the decisive moment.
3. Payload. The hidden code executes: it steals, encrypts, opens a backdoor, or fetches the next stage.
4. Persistence, optional. Depending on the payload, the trojan may set up to survive a reboot, or it may do its work and leave.

Everything before step two is the attacker working on a person. Everything after is the payload doing its job. Both halves are where defense lives.

How to defend against trojans

Because the attack pivots on a human decision, controls stack on both sides of it: reduce the chance a lure reaches a person, and limit the damage if one gets executed.

1. Filter the delivery. Strong email and web filtering, attachment scanning, and blocking risky file types cut how many lures ever reach a person. Fewer lures means fewer decisions to get wrong.
2. Restrict what can run. Application control and allow-listing stop unapproved executables, scripts, and installers from running at all, which neutralises a trojan even after someone opens it.
3. Enforce least privilege. A trojan that runs as a standard user can do far less than one that runs as administrator. Deny everyday accounts admin rights.
4. Keep the payload from succeeding. Behavioural endpoint detection catches what the trojan does after execution, the shell, the encryption, the beacon, even when the file itself was unknown.
5. Train for the specific lures. Teach people the current patterns: cracked software, fake updates, and paste-a-command prompts. Awareness is the control that operates at the exact moment of decision.
6. Make the safe path easy. Provide a trusted software source and a fast way to report suspicious files, so people do not go looking for risky downloads or stay silent when something feels off.

Trojans endure because they attack the one part of the system you cannot patch: a person's judgment at the moment of a double-click. The upside is that the same human step is a dependency you can plan around. Cut down the lures that reach people, control what is allowed to run, keep privileges low, and catch the payload behaviourally if a lure slips through. Defend the delivery, and you defend against every payload a trojan might have carried.

A worked example: the fake meeting installer

It helps to walk one lure end to end, because the individual steps are ordinary and that ordinariness is the point. Nothing here requires an exploit. Every stage is a design choice aimed at a person's expectations.

An employee receives a calendar invite for a client call. The invite looks routine, with a real-sounding company name and a link to join a video meeting. Clicking the link opens a page that says the meeting needs a small plugin to start, and offers a download named something like meeting-setup.exe or ClientCall-Installer.msi. The page is styled to resemble a familiar conferencing brand, and the file carries an icon copied from that brand. So far the victim has done nothing unusual. People install conferencing helpers all the time.

The victim runs the installer. Two things now happen at once. A real-looking progress bar appears, and behind it the payload writes itself to a user-writable directory, sets a registry run key or a scheduled task for persistence, and reaches out to a command-and-control host. The progress bar is not decoration. It is there so the victim waits calmly instead of noticing that no meeting ever opens. By the time the victim realises the call is not starting and closes the window, the payload is resident.

Notice what the attacker never needed. No memory corruption, no privilege escalation exploit, no unpatched service. The trojan borrowed the victim's own permission to run software. If the victim was a local administrator, the payload inherited that power. If the victim ran as a standard user, the payload is still resident but boxed into what that account can touch, which is exactly why least privilege changes the outcome of this same story.

The lesson from the walkthrough is that the decisive control is the one nearest the double-click. Everything downstream, the persistence, the beacon, the theft, is the payload doing its job. The one moment where a warning, an application-control block, or a trained instinct could have stopped the whole chain was the instant before execution.

How to detect a trojan

Because a trojan carries no single signature, detection leans on the behaviour a payload shows after it runs and on the oddities of the file before it does. The concrete signals fall into a few groups.

Signals in the file and its delivery:

• An executable, script, disk image, or installer arriving as an email attachment or a direct download when the sender or context did not warrant it.
• A double extension or a mismatched icon, for example a file named invoice.pdf.exe or a document icon on an executable.
• An installer or "update" served from a search ad, a messaging app, or a lookalike domain rather than the vendor's real download page.
• A signed binary whose signature is absent, invalid, or from an unexpected signer, which matters because attackers abuse code signing to look legitimate.

Signals at execution and after:

• A newly written file in a user-writable location such as the user profile, temporary directories, or a public folder, followed immediately by that file launching.
• A common application spawning a command interpreter or a scripting host, for example a document viewer or browser starting powershell, cmd, wscript, or mshta.
• A new persistence entry appearing at the same time: a registry run key, a scheduled task, a service, or a startup-folder shortcut.
• Outbound network connections to a host or domain the machine has never contacted, especially on a beacon-like interval.
• A process reading credential stores or browser databases shortly after launch, which points to a stealer payload.

Trojan compared with virus, worm, and dropper

The malware vocabulary mixes delivery methods, propagation methods, and payloads, which is why the terms feel slippery. Placing them side by side shows where a trojan sits and why the label describes arrival rather than function.

Term	What the word describes	How it moves	Needs a human to run it
Trojan	A delivery disguise around a payload	Does not self-propagate	Yes, that is the definition
Virus	Code that inserts copies into other files	Spreads by infecting host files that are then shared or run	Usually, when an infected host runs
Worm	Self-replicating code	Spreads across a network on its own, often via a vulnerability	No, it propagates without a user
Dropper	A stub whose job is to install a payload	Carried in, then writes the real malware	Often, if the dropper is itself a trojan
Backdoor	A payload that preserves re-entry	Placed by another stage	No, it is a result, not a delivery

The table makes the relationships concrete. A worm spreads by itself and a trojan cannot, so the two are opposites on propagation. A dropper is frequently delivered as a trojan and then installs the payload, so the categories overlap in a single attack. A backdoor is a payload a trojan might carry, not a rival delivery method. Holding these apart keeps you from defending the wrong property, for example expecting network segmentation to stop a trojan the way it slows a worm.

Common misconceptions

A few beliefs about trojans are widespread and each one leads to a real gap.

"A trojan is a type of virus." It is not. A virus is defined by self-replication into other files; a trojan does not replicate at all. Conflating them leads people to expect antivirus signatures to catch every trojan, when the payload is often novel and the wrapper is disposable.

"My antivirus will catch it." Signature-based scanning catches known files. Attackers regenerate the wrapper constantly, so the exact file you receive may never have been seen before. Behavioural detection and application control matter precisely because the file-level signature so often misses.

"I only download from search results, so I am safe." Search ads and poisoned results are a primary trojan channel. A top result for a popular free download is one of the most reliable ways attackers reach careful users, because the victim believes they navigated there themselves.

"A standard user account cannot get infected." A trojan running as a standard user is limited, which is valuable, but it can still steal that user's data, read browser sessions, and beacon out. Least privilege reduces the blast radius; it does not make execution harmless.

"Macros and scripts are not real programs, so they are lower risk." Active content in documents, along with script hosts, is one of the most common trojan formats precisely because people underestimate it. A script can do everything a compiled executable can within the user's rights.

How the technique evolved

The disguise is ancient, but the packaging keeps shifting with whatever people currently trust. Early trojans hid in shared programs and pirated software passed hand to hand. As email became universal, the attachment became the vehicle, and the classic double-extension file rode in on messages that impersonated invoices and shipping notices. When office documents gained scripting, macro-bearing documents took over for a long stretch, until default blocking of macros from the internet pushed attackers toward other formats.

The current wave reflects two shifts. First, attackers moved to formats that slip past attachment filters, including disk images, archive files, and shortcut files that launch scripts. Second, and more striking, is the rise of the paste-a-command lure, where the victim is convinced to copy a command from a webpage and run it themselves, removing the need to deliver a file at all. The through line across every era is constant. The technology of the disguise changes, and the human decision it targets does not. Whatever people are conditioned to trust this year becomes next year's wrapper.

What the payload does once it lands

Since the trojan is only the wrapper, the consequences depend entirely on what it carried, and it helps to know the common outcomes so response can be scoped correctly. Each payload family leaves a different footprint and calls for a different first move.

A stealer runs fast and leaves. It reads browser-stored passwords, session cookies, saved cards, and cryptocurrency wallet files, packages them, sends them out, and often deletes itself. The window to catch it is short, and the correct response assumes the stolen credentials and sessions are already compromised, so the priority is rotating passwords and invalidating sessions rather than only cleaning the machine.

A remote access trojan settles in and waits. It opens a channel for an operator to browse files, run commands, capture the screen, and log keystrokes on demand. Because a human is on the other end, the activity is irregular and blends with normal use, so detection leans on the persistence it installs and the command channel it keeps open.

Ransomware and wipers announce themselves. Encryption or destruction is loud by design, and by the time it is visible the damage is largely done, which is why the defensive weight sits earlier, on stopping execution and on tested backups.

A downloader is the quiet one. Its only job is to fetch and run the real payload, which means an infection that looks minor can pull in anything next. Finding a downloader is a signal to hunt for the second stage rather than to relax.

Mapping the observed behaviour back to the payload family tells you how urgent the response is and where to point it. The trojan got the code in; the family determines what the incident actually is.

Frequently asked questions

Is a trojan a virus?

No. A virus self-replicates by inserting copies of itself into other files. A trojan does not replicate; it relies on a person choosing to run it. They are different categories, one a propagation method and the other a delivery disguise, even though everyday speech often blurs them.

Can a trojan spread to other computers by itself?

Not on its own. A pure trojan has no self-propagation. It can, however, carry a payload that then spreads, or an operator who gains access through a trojan can move laterally using other techniques. The trojan itself waits for a human to run it each time.

Does antivirus stop trojans?

Partly. Signature-based antivirus catches known trojan files, but attackers regenerate wrappers to stay ahead of signatures. Behavioural detection, application control, and least privilege carry more weight because they act on what the payload does rather than on the specific file.

What is the difference between a trojan and a RAT?

A trojan is how malware arrives, disguised as something wanted. A remote access trojan (RAT) is a payload that a trojan might deliver, giving an operator hands-on control of the machine. A RAT is one of the things a trojan can carry, not a competing category.

Are Mac and Linux safe from trojans?

No. A trojan is a social technique, not a Windows-specific exploit, so it works on any platform where a person can be convinced to run a file. The wrappers differ by platform, but the core trick, a wanted-looking program that hides a payload, applies everywhere.

Why do I need application control if I have antivirus?

Antivirus asks whether a file is known-bad. Application control asks whether a file is on your approved list, which blocks unknown executables and scripts regardless of whether anyone has ever flagged them. Against a freshly generated trojan wrapper, the allow-list decision holds where a signature lookup misses.

What is the single most effective control?

There is no single control, but restricting what can execute comes closest, because it neutralises the payload even after a person is tricked into running the file. Pair it with least privilege so that anything which does run is boxed into a limited account, and with behavioural detection to catch the payload if it executes.

Related guides

• What Is a RAT
• What Is an Infostealer
• Attacker File Formats Explained
• What Is Phishing
• Social Engineering Playbook