Trojan (Trojan horse)
Trojan horse · RAT · remote access Trojan · loader · dropper · cheval de Troie
Malware disguised as a legitimate program or document that secretly opens a way in for the attacker once the victim installs it themselves.
In practice
Unlike a worm, a Trojan does not spread on its own: it relies on the victim to open it (a fake invoice, pirated software, a fake video-conferencing tool, a browser extension). Once running, it can steal credentials, provide remote control (a RAT) or download further malware such as ransomware. Many serious attacks begin this way, long before any data is encrypted.
First seen in 2014 as a banking Trojan, Emotet became one of cybercrime’s main “loaders”: spread through malicious attachments, sometimes as replies within genuine stolen email threads, it then installed other malware such as TrickBot, a gateway to ransomware. An international operation coordinated by Europol took it down in January 2021.
How to protect yourself
- Install software only from official sources, and work without administrator rights day to day.
- Block macros in documents from the internet and filter risky attachment types.
- Deploy EDR and watch for outbound connections to unknown servers.
- Check any unexpected attachment with the sender, even inside an existing conversation.
