Malware

Once it runs, malware can cause harm in many ways. It can lock a device or make it unusable, steal, delete, or encrypt data, take control of a device to attack other organizations, obtain credentials that give access to an organization's systems, or mine cryptocurrency. Criminals also use it to steal personal information such as usernames, passwords, and bank account numbers.

Malware often arrives through phishing. A deceptive email tricks the recipient into clicking a link or opening an attachment that downloads it, or links to a website that hosts it. Attackers can also force their code to run by exploiting vulnerabilities in a device, and botnets of infected devices are used to spread more malware.

No organization can be fully protected against infection, so the NCSC recommends defense in depth. It uses layers of defense with several mitigations at each layer, which give more chances to detect malware and stop it before it causes harm. The layers include email filtering and blocking known malicious websites so malware is not delivered, allowing only trusted applications to run, installing security updates as soon as they are available, keeping offline backups, and planning for an attack.

For personal devices, the FTC advises security software that updates and scans new files automatically. Signs of infection include a device that slows down, freezes, or crashes, a browser home page that changes on its own, and many pop-up ads. After a suspected infection, the FTC advises stopping logins to sensitive accounts, running a security scan, then changing passwords and turning on two-factor authentication.