A computer virus spreads a lot like a cold — it needs to get from one place to another, usually by hitching a ride on something you trust.
Viruses often hide inside seemingly-normal downloads — a "free" game, a cracked piece of software, or a file attached to an email that looks like an invoice or a shipping notice. This is the oldest and still most common delivery method, and the malware itself usually falls into one of a small number of well-understood categories, even as the specific attacks constantly change.
By far the most common category is trojans — malicious software disguised as something legitimate — accounting for roughly 58% of all malware detections. Ransomware, despite being the type that makes headlines, actually accounts for a much smaller 14% of overall malware volume; it just causes disproportionate financial damage per incident because of its extortion model. Worms make up about 10%, capable of spreading on their own without anyone clicking anything; adware sits at 8%; spyware, which quietly harvests credentials and keystrokes, at 6%; and cryptominers and other specialized malware fill out the remaining 4%.1
Worth knowing: "virus" itself is technically a narrower, older term than most people use it for. A true computer virus specifically attaches itself to another legitimate program and only spreads when that host program runs — closer to its biological namesake than most modern malware actually behaves. Nearly everything discussed here, from trojans to worms to ransomware, falls under the broader umbrella term "malware," even though "virus" has become the everyday word people reach for regardless of which specific type they mean.
Once inside one computer on a network, some malware — particularly worms and modern ransomware strains — actively search for other connected devices and copy themselves over automatically, without anyone clicking anything at all. This propagation behavior is exactly why ransomware in particular disproportionately devastates smaller organizations: Verizon's 2025 Data Breach Investigations Report found ransomware present in 88% of breaches at small and medium-sized businesses, compared to just 39% at larger organizations.2 Larger organizations typically have more network segmentation in place — the internal walls that stop an infection in one area from reaching everything else — while smaller networks are often flat, with every device able to reach every other device freely.
Modern malicious software is often disguised as something boring and routine — a fake invoice, a fake shipping notice, a fake software update — precisely so it doesn't look suspicious at first glance. And it's genuinely getting more common, not less. OpenText's 2024 telemetry found a malware infection rate of 2.39% on business PCs, more than 28% higher than the year before, with consumer devices actually running slightly higher at 3.07% — a reminder that this isn't purely a workplace problem.3 That climb isn't a one-time spike; it tracks a broader, steady increase in both the volume and sophistication of malware being distributed.
Not all malware causes damage immediately. Some sits quietly, watching or collecting information, waiting for the right moment or a signal from the attacker before doing anything noticeable at all. This patience is deliberate — the longer malware avoids detection, the more it can accomplish before anyone notices anything wrong, which is exactly why detection speed matters as much as prevention does.
A lot of modern malware also arrives in stages, rather than as one single file doing everything at once. A small initial piece — often called a dropper or loader — has one narrow job: get onto the device quietly, then reach out and download something bigger and more capable once it's established. This staged approach helps malware slip past defenses that are only looking for known, complete threats, since the first-stage file often looks harmless or unremarkable on its own. It also tends to succeed specifically when it lands on an account with more privileges than it strictly needs — which is exactly why limiting user permissions to only what's actually required matters as a defense, even when nothing looks obviously wrong yet.
Malware doesn't need to be exotic to be effective — most of it succeeds through routine deception, not sophisticated technical tricks. A few practical takeaways: