The operating system is the foundation everything runs on — it manages processes, memory, files, permissions and the network. Malware doesn't defeat the OS; it abuses it, turning the system's own features into a foothold. This page covers how the major operating systems work and protect themselves, the full taxonomy of malware with real-world examples, how an infection actually behaves once it runs, and how it's detected and stopped.
Everything malware wants to do — run code, read files, steal credentials, talk to the network — goes through the OS. Understanding what the kernel controls is understanding what an attacker is trying to subvert.
| OS | Security model in brief | Why it's targeted |
|---|---|---|
| Linux | POSIX permissions (user/group/other rwx), UID 0 = root, SELinux/AppArmor for MAC | Runs most servers, cloud and containers — high-value, often internet-facing |
| Windows | ACLs, access tokens, UAC, SIDs; Active Directory for domain identity | Dominant on desktops/enterprise; the AD estate is the crown jewel |
| macOS | Unix base + SIP, Gatekeeper, TCC, notarisation, sandboxing | Strong defaults, but a prime target in high-value / executive attacks |
| Android | App sandboxing, permission prompts, Linux kernel underneath | Huge, fragmented install base — data theft and surveillance |
Code runs in one of two rings. User space is where normal applications live, isolated from each other. Kernel space has full control of the machine. Malware that reaches the kernel (a rootkit) can hide from everything running above it — which is why kernel integrity (Secure Boot, driver signing, PatchGuard) matters so much.
Malware needs a way onto the box and a way to run with enough privilege. These are the recurring openings:
admin:admin still works far too oftenIt's the entry point. Almost every weakness above is a configuration or maintenance gap, not a flaw in the OS design. Patch, harden and monitor, and most malware never gets its first foothold.
"Malware" is a family, not a thing. The categories overlap (modern threats are often blends), but each describes a distinct behaviour. The real-world examples are worth knowing — they're how these ideas show up in practice and in exams.
| Type | Defining behaviour | Real-world example |
|---|---|---|
| Virus | Attaches to a file/program; spreads when the host is run by a user | ILOVEYOU (2000) — VBScript, ~$10bn damage |
| Worm | Self-replicates across networks with no user action | Morris Worm (1988); Conficker (2008) |
| Trojan | Poses as legitimate software; opens a backdoor once run | Emotet; Zeus banking trojan |
| Ransomware | Encrypts data and demands payment for the key | WannaCry (2017); Colonial Pipeline / DarkSide (2021) |
| Wiper | Destroys data outright — disguised as ransomware but no recovery intended | NotPetya (2017) — ~$10bn global damage |
| Spyware / Keylogger | Covertly records activity, keystrokes and data | Pegasus (NSO Group) — mobile surveillance |
| Rootkit / Bootkit | Hides malware at OS/firmware level for stealthy persistence | Stuxnet (2010) used rootkit components |
| RAT (Remote Access Trojan) | Gives the attacker full interactive remote control | DarkComet; njRAT |
| Botnet / Zombie | Enlists the device into a controlled network for DDoS/spam | Mirai (2016) — IoT botnet, record DDoS |
| Cryptominer | Hijacks CPU/GPU to mine cryptocurrency (cryptojacking) | Coinhive-style in-browser miners |
| Fileless | Lives in memory / abuses legitimate tools; little on disk | PowerShell / WMI-based intrusions |
Modern attacks rarely fit one box. SolarWinds / SUNBURST (2020) was a trojanised software update (supply-chain) that delivered a stealthy backdoor to thousands of organisations at once — part trojan, part RAT, part espionage platform. Categories are a vocabulary, not a cage.
Malicious links and documents (macro-enabled Office files, ISO/LNK droppers). Still the dominant delivery method by a wide margin.
Compromised or malicious websites and ad networks that exploit the browser or trick a download.
Cracked software, fake installers and trojanised apps — the user invites it in.
Infected USB drives — how Stuxnet crossed into air-gapped networks.
Attacking known holes in internet-facing software — the worm route (EternalBlue).
Convincing a person to run the payload themselves — the hardest vector to patch.
Getting in is only the start. A capable threat follows a recognisable sequence — and each stage is a chance to detect and disrupt it.
wscript, bash).Almost all modern malware beacons out to a C2 server — for new commands, to exfiltrate data, or to receive the ransomware encryption key. This outbound channel is often the easiest thing to detect: unexpected, regular connections to unfamiliar domains or IPs. Cutting C2 can neutralise an infection even before it's fully understood.
Persistence is where malware hides its "restart me" hooks. Knowing the common locations is exactly how analysts find and remove it.
| Platform | Mechanism | ATT&CK ID |
|---|---|---|
| Windows | Registry Run / RunOnce keys | T1547.001 |
| Windows | Scheduled Tasks | T1053.005 |
| Windows | New / hijacked Services | T1543.003 |
| Windows | WMI event subscription | T1546.003 |
| Linux | cron jobs | T1053.003 |
| Linux | systemd services | T1543.002 |
| Linux/macOS | Shell profile / rc files (.bashrc) | T1546.004 |
| macOS | Launch Agents / Daemons | T1543.001 / .004 |
Tools like Sysinternals Autoruns enumerate nearly every persistence location on Windows in one view — the fastest way to spot "what runs at boot that shouldn't."
Examining the sample without running it — strings, hashes, imports, signatures. Fast and safe, but obfuscation and packing limit it. YARA rules match known patterns at scale.
Detonating it in an isolated sandbox (Cuckoo, Any.run) and watching behaviour — files touched, registry changes, network calls. Reveals what the code actually does.
| Control | What it buys you |
|---|---|
| Patch management | Closes the known-CVE entry and worm routes |
| Least privilege | Malware inherits the user's rights — fewer rights, smaller blast radius |
| Application allow-listing | Only approved binaries run; unknown payloads simply can't execute |
| EDR / XDR | Behavioural detection of execution, persistence and C2 on the endpoint |
| Backups — the 3-2-1 rule | 3 copies, 2 media, 1 offline/off-site — the real answer to ransomware |
| Network monitoring | Catches C2 beaconing and exfiltration leaving the network |
| User awareness training | Shrinks the phishing / social-engineering vector |
Paying rarely restores everything and funds the next attack. Tested, offline backups are the only reliable recovery — and the NCSC advises against paying. Prevention (patch, least privilege, segmentation) plus recovery (backups) beats any detection alone.