Malicious code, or malware, is a program covertly inserted into another program or system to destroy data, run intrusive programs or compromise confidentiality, integrity or availability. Classic examples are viruses, worms and trojans. They spread through files, network services, email and web pages, and you stop them with layers, not one tool.
What are the classic categories?
NIST SP 800-83 Rev. 1 lists the traditional forms. A virus self-replicates by inserting copies of itself into host programs or data files, and usually needs a person to open a file or run a program. A macro virus is one variety: it abuses the macro language inside office documents.
A worm is self-replicating and self-contained and usually runs without user action. A network service worm exploits a vulnerability in a network service to reach other hosts. A mass mailing worm spreads by email on its own.
A Trojan horse does not replicate. It looks benign but has a hidden malicious purpose, and often delivers other attacker tools. Malicious mobile code is software that travels from a remote host and runs locally, typically without the user's explicit instruction, in languages such as JavaScript. NIST adds attacker tools that malware can drop: backdoors that listen for commands, rootkits that alter normal host functionality, and keystroke loggers.
How does it actually spread?
Look at the routes rather than the labels. Files and attachments carry viruses and trojans. Exposed services carry worms: one unpatched network service on one machine becomes the entry point to its neighbors. Web pages carry drive-by downloads, where a visit to an infected site triggers an attempt to exploit the visitor's browser or plugins and then install attacker tools. NIST notes this case barely fits the classic categories, because the site is infected but the malware does not infect the user's computer; it works as an attacker tool that installs others.
Social engineering sits under all of these. People are tricked into opening files that look ordinary, which is why NIST says current malware leans heavily on it.
Why do the categories matter less now?
NIST's own guide says classic categories have become less useful. Many instances are blended attacks that use several infection or transmission methods, and handling procedures are now largely the same for all malware incidents. It recommends organizations avoid spending substantial time categorizing each incident.
That is a helpful message for responders. Spend the first hour on scope and containment, not on whether the sample is technically a worm.
What does one incident look like?
A constructed example. An accountant opens a spreadsheet attached to an invoice email. A macro runs and downloads a second program. That program scans the local network, finds a file server with an unpatched service, and copies itself over. Within an hour, three machines are talking to an address nobody recognizes. The spreadsheet was a trojan-style delivery, the spread was worm-like, and the later tools were backdoors. Three labels, one event.
How do you stop it?
NIST's prevention chapter groups controls into policy, awareness, vulnerability mitigation, threat mitigation, and defensive architecture. Under threat mitigation it lists antivirus software, intrusion prevention systems, firewalls, content filtering and inspection, and application whitelisting. Defensive architecture includes sandboxing, browser separation and segregation through virtualization.
Each layer catches what the one before missed. Patching closes the worm's way in. Allow listing stops an unknown program from starting. A host firewall that blocks workstation to workstation traffic limits what a compromised machine can reach.
How to check or apply this
- Patch operating systems, browsers and network services on a fixed schedule, with internet-facing systems first.
- Disable macros from the internet by default in office applications, and allow signed or approved ones only where needed.
- Use application allow listing on servers and, where practical, on laptops.
- Run endpoint protection and keep its definitions current.
- Filter email attachments and web content, and detonate unknown files in a sandbox where you can.
- Segment the network and turn on host firewalls so one infected machine cannot reach everything.
- Write a malware incident plan: who isolates a host, who decides, how to preserve evidence, how to restore.
- Check your software supply chain too. Dependencies can carry malicious code into builds, and Safeguard's dependency scanning flags known vulnerable packages before they ship.
Quick check
What is the difference between a virus and a worm?
A virus attaches itself to files or programs and typically needs a person to run them. A worm is self-contained and spreads by itself, often through a vulnerable network service.
Does it matter which category an incident belongs to?
Less than it used to. NIST notes blended attacks are common and handling procedures are now largely the same, so focus on containment and scope.
Sources
- NIST SP 800-83 Rev. 1, Guide to Malware Incident Prevention and Handling for Desktops and Laptops
- NIST SP 800-83 Rev. 1 publication page
Last reviewed: 18 October 2026.
