Trojan Malware Explained: Types And How To Protect Yourself

Last updated: October 2026

A trojan is one of the oldest tricks in computing, and it still works because it runs on trust. You think you are installing a useful app, opening an invoice, or updating a program you already know. Instead, you let in software that quietly does something very different once it is on your device.

This guide explains what a trojan is, how it differs from malware in general and from a virus in particular, and the signs that suggest a device is infected. It then walks through safe removal steps, in order, and finishes with the habits that stop most trojans before they ever get a chance to run.

What Is a Trojan?

The name comes from the ancient story of Troy, where soldiers hid inside a giant wooden horse that the city willingly pulled through its own gates. A digital trojan works the same way. It is malicious software that disguises itself as something harmless, useful, or familiar, so that you install or open it yourself.

That disguise is the whole point. A trojan might pose as a game, a PDF invoice, a video player, a delivery notice, or a fake update for software you trust. Nothing about the file looks dangerous. The damage starts only after you run it, which is why trojans are classed as a social engineering attack as much as a technical one.

Once active, a trojan can do almost anything its creator wants. Some steal passwords and banking details. Some open a hidden door so an attacker can control the device later. Others download more malware, lock your files for ransom, or spy on everything you type.

Trojan vs Malware vs Virus: What Is the Difference?

These three words are often used as if they mean the same thing, but they do not. Malware is the umbrella term for any software built to harm a device, steal data, or spy on a user. Trojans, viruses, worms, ransomware, and spyware are all types of malware. Our in-depth guide to what spyware is and how it works covers one of those families in detail.

A virus is defined by how it spreads. It attaches itself to a clean file or program, and when you run that file, the virus copies itself into other files. Over time it can spread across a device and onto other devices through shared files. A virus needs a host file and, usually, a person to launch it.

A trojan is defined by deception, not by self-copying. A trojan does not infect other files or replicate itself. It relies on looking legitimate so you invite it in. One fake installer can still do enormous harm, because the trojan can fetch viruses, ransomware, or spyware as a second stage after it is installed. In short, all trojans and all viruses are malware, but a trojan is not a virus, even though people often say trojan virus in everyday speech.

How Trojans Get Onto a Device

Because a trojan cannot spread on its own, it needs a convincing delivery method. These are the routes security teams see most often.

• Fake downloads: Cracked software, free game mods, key generators, and pirated media are classic hiding places, because the user expects the file to do something unusual.
• Email attachments and links: A fake invoice, shipping notice, or tax document that urges you to open the attachment right away is still one of the most common tricks.
• Fake updates: Pop-ups claiming your browser, media player, or antivirus is out of date can install a trojan instead of a real update.
• Bundled installers: Free utilities sometimes bundle extra software. Rushing through setup screens without reading them can install far more than you intended.
• Malicious ads and compromised sites: A poisoned advert or hacked website can push a fake download or exploit an outdated browser.
• Messaging apps and removable drives: Trojans also travel in files shared through chat apps, file-sharing groups, and infected USB drives.

Common Types of Trojans

Trojans are grouped by what they do after they are installed. You do not need to memorise this list, but recognising the main families helps you understand why two infections can look completely different.

• Backdoor trojans open a hidden entrance to your device, so an attacker can connect later, run commands, and install more tools.
• Downloader trojans do very little themselves. Their job is to fetch and install other malware once they are safely inside.
• Banker trojans target money. They watch for banking and payment activity, steal login details, and can alter transaction screens.
• Ransom trojans lock your files or your whole device and demand payment for access. Good offline backups are the strongest answer to this type.
• Rootkit trojans hide deep in the system and conceal other malware, which makes the whole infection harder to find and remove.
• Fake antivirus trojans pretend to be security software. They show alarming warnings, then charge you to fix problems that do not exist. Read our guide on how to protect yourself against fake antivirus software before you ever pay for a pop-up warning.
• Spy trojans record keystrokes, take screenshots, and track activity. They overlap with system monitors and monitoring software, which is why understanding that category helps you spot abuse.
• DDoS trojans turn your device into part of a botnet that floods websites with traffic, often without you noticing anything more than a slow connection.
• SMS trojans attack phones. They send premium-rate messages, intercept one-time codes, or hide subscription charges on your bill.
• Credential stealers hunt for saved passwords, browser cookies, game accounts, and crypto wallet files, then send them to the attacker.

Signs Your Device May Be Infected

Trojans prefer to stay quiet, but few stay invisible forever. Watch for a pattern of these signs rather than any single glitch, because one slow afternoon proves nothing on its own.

• Your computer or phone suddenly runs slowly, overheats, or crashes and restarts often.
• New programs, browser extensions, or toolbars appear that you do not remember installing.
• Your browser homepage or default search engine changes, or searches redirect to unfamiliar sites.
• Pop-ups and fake security warnings appear even when your browser is closed.
• Your antivirus or firewall is switched off, or its settings change without you touching them.
• Friends receive messages from your accounts that you never sent.
• Data use or battery drain jumps for no clear reason, which can mean something is working in the background.
• Passwords stop working, or you see login alerts and bank transactions you do not recognise.

Any one of these can have an innocent explanation. Several together, especially right after installing something new, should be treated as a warning and checked with a proper scan.

What a Trojan Can Do Once It Is Inside

The first trojan is often just the door opener. After it checks in with the attacker, it can download a second payload chosen for your device. That might be a keylogger that records every password you type, ransomware that locks your photos and documents, or spyware that copies messages and files in the background.

Some trojans simply sit and wait. A device in a botnet may behave almost normally for months while it is used to send spam or attack websites. That is why removal matters even when nothing looks badly wrong. A quiet infection is still an infection, and it is still under someone else’s control.

How to Remove a Trojan, Step by Step

Work through these steps in order. Do not log in to banking or other sensitive accounts on the infected device until the final rescan is clean.

1. Disconnect from the internet. Turn off Wi-Fi or unplug the cable. This stops the trojan from sending data or downloading more malware while you work.
2. Write down what you noticed. Note the warning signs, the date they started, and anything you installed shortly before. This helps if you need professional help later.
3. Restart in Safe Mode. On Windows, Safe Mode loads only essential services, which often stops the trojan from launching and defending itself. On a Mac, check your login items for anything unknown. On Android, Safe Mode disables third-party apps, which makes a bad app easy to spot and remove.
4. Run a full scan. Use the security software already on your device, fully updated, and run its deepest full scan rather than a quick scan. Built-in tools such as Microsoft Defender are a solid starting point. A second opinion scan from another reputable vendor is a sensible check.
5. Quarantine or remove everything found. Follow the scanner’s guidance. Then uninstall any program or phone app you do not recognise, and clear temporary files so leftovers have nowhere to hide.
6. Clean your browsers. Remove unknown extensions, reset a changed homepage and search engine, and update the browser itself. On a phone, also check for unknown device admin apps and, on iPhone, remove any configuration profile you do not recognise.
7. Restart normally and scan again. A second full scan in normal mode should come back clean. If the same threat keeps returning, the infection may be a rootkit, and a full system reinstall or professional repair is the honest fix.
8. If a phone stays infected, reset it. Back up photos and documents only, not apps, then factory reset and reinstall apps from the official store one by one. Our guide to mobile spyware and how to protect against it covers phone-specific warning signs in more depth.

After Removal: Secure Your Accounts

Cleaning the device is only half the job. If a trojan watched you type, your passwords may already be gone. Using a different, clean device, change the passwords for your email, banking, and shopping accounts first, because email password resets unlock almost everything else.

Turn on multi-factor authentication or passkeys wherever they are offered, review recent bank and card statements, and check account activity pages for sessions you do not recognise. Sign out of all sessions where the service allows it. Stay alert for a few weeks, because stolen details are not always used right away.

How to Protect Yourself From Trojans

Prevention is far easier than removal. Most infections trace back to one rushed click, so these habits focus on slowing that moment down.

• Keep everything updated. Turn on automatic updates for your operating system, browser, and apps. Many trojans rely on flaws that were fixed months earlier.
• Download from official sources only. Use the maker’s own site or the official app store. Treat cracked software and free download portals as high risk, because they are.
• Slow down with attachments and links. Check the real sender address, and if a message creates panic or urgency, contact the company through its official site instead of the message itself.
• Use reputable security software. Keep real-time protection on and let it scan new downloads before you open them.
• Browse with a safer setup. A hardened, privacy-focused browser reduces tracking and blocks many malicious sites. See our roundup of the most secure browsers for options worth switching to.
• Back up your files. Keep at least one copy of important files that is not always connected, such as an external drive you unplug. Backups turn a ransom demand into an inconvenience.
• Use strong, unique passwords and multi-factor authentication. If one account falls, the others should not fall with it.
• Read installer screens. Decline bundled extras and optional offers. If a free program pushes several add-ons, that is a reason to walk away.

Final Thoughts

A trojan succeeds by looking ordinary. That is also its weakness, because a few seconds of suspicion at the download or the attachment stops most of them cold. Keep your software updated, be picky about where files come from, and treat sudden changes in your device’s behaviour as something worth scanning, not ignoring.

If you do find an infection, disconnect, scan, remove, rescan, and then secure your accounts in that order. For a wider routine that covers your whole online life, read our practical tips to stay safe on the internet and protect your data. A calm, methodical response will fix most trojan infections without any lasting damage.