Trojan
A Trojan, also known as a Trojan horse, is a type of malware that masquerades as legitimate programs or files to infect a computer or mobile device. Unlike viruses, Trojans do not replicate themselves but can open doors to other malicious activities such as data theft, additional malware installation, or remote device control.
Trojan Definition
Trojan, also known as a Trojan horse, is a type of malware that masquerades as legitimate programs or files to infect a computer or mobile device. Unlike viruses, Trojans do not replicate themselves but can open doors to other malicious activities such as data theft, additional malware installation, or remote device control.
What is a trojan, in one sentence? It is a program that pretends to be useful or harmless while actually carrying a hidden, malicious task. The NIST SP 800-83 guidelines describe a trojan as a self-contained program that does not replicate, swaps existing files for malicious versions or adds new ones, and frequently brings further attacker tools onto the computer. The NIST glossary adds an important detail: a trojan can get around security controls by using the permissions of the person who launched it. Trojan types, infection symptoms and protection are covered in more depth in the article What is a trojan — types, detection, protection.
How Does a Trojan Work?
A Trojan works by hiding its malicious code in legitimate-looking applications or files. After installation on a device, a Trojan can perform various malicious actions, such as:
- Data Theft: Capturing login credentials, credit card numbers, and other confidential information.
- Remote Control: Allowing attackers remote access and control of the infected device.
- Additional Malware Installation: Downloading and installing other malicious programs.
- Spying: Monitoring user activity, including keystrokes and network traffic.
- Resource Exploitation: Using the infected device to conduct DDoS attacks or mine cryptocurrency.
Trojans in the Workplace — How Does the Attack Unfold and Where Can You Stop It?
In an organisation a trojan rarely “arrives on its own”. The typical sequence has three stages, and each of them is a chance to stop it:
- An employee runs it. The MITRE ATT&CK knowledge base (technique T1204.002) describes attackers counting on someone opening a malicious file — most often after an email with an attachment. The file poses as a document or program with a familiar name, is sometimes packed with a password given in the message, and comes as, for example, an Office document, a PDF, an executable, an LNK shortcut or an ISO image.
- Changes on the computer. Once launched, the trojan swaps files or adds its own and pulls in further tools (NIST SP 800-83).
- More malware. The US agency CISA has described Emotet — a trojan acting mainly as a downloader of other malicious software — which dropped TrickBot, among others, leading to ransomware.
Where can the chain be broken? NIST recommends disabling application features that malware commonly abuses — for example allowing macros only from trusted locations — and application control (whitelisting), which lets only approved programs run; it is worth starting the rollout in audit mode so that needed software is not blocked. If a trojan still gets started, what counts is quickly detecting its behaviour on the workstation and isolating the device — which is the scope of our Managed EDR/XDR service.
Types of Trojans
- Trojan-Downloader: Downloads and installs other malware.
- Trojan-Dropper: Hides malware in legitimate files and installs it on the device.
- Trojan-Banker: Steals user banking data.
- Trojan-Spy: Monitors user activity and transmits collected information to the attacker.
- Trojan-Ransom: Encrypts user data and demands ransom for decryption.
- Trojan-Backdoor: Creates a backdoor enabling remote access to the infected device.
Trojan Infection Methods
- Downloading from unknown sources: Installing software from unknown or untrusted websites.
- Email attachments: Opening attachments in emails from unknown senders.
- Fake updates: Installing fake software updates.
- Advertisements and pop-ups: Clicking on suspicious advertisements and pop-up windows.
- Social media: Clicking on malicious links shared on social platforms.
Threats Associated with Trojans
- Identity Theft: Gaining access to personal and financial data.
- Data Loss: Encryption or deletion of user files.
- Remote Control: Attacker takeover of the device.
- Espionage: Monitoring user activity without their knowledge.
- Resource Exploitation: Using system resources to conduct attacks or mine cryptocurrency.
How to Detect a Trojan?
- System Slowdown: Unusual slowdown of computer or mobile device operation.
- Unknown Processes: Presence of suspicious processes in task manager.
- Pop-ups: Appearance of unexpected advertisements and pop-ups.
- Settings Changes: Unintended changes in system or browser settings.
- Unknown Programs: Appearance of unknown applications or files.
Trojan Removal Methods
- Antivirus Software: Using up-to-date antivirus software to scan and remove the Trojan.
- Safe Mode: Starting the computer in safe mode and performing a scan.
- Manual Removal: Identification and removal of infected files and registry entries (recommended for advanced users).
- System Restore: Restoring the system to a state before infection.
- System Reinstallation: In extreme cases, reinstalling the operating system.
Protection Against Trojans
- Software Updates: Regularly updating the operating system and applications.
- Antivirus Software: Installing and regularly updating antivirus programs.
- Safe Browsing: Avoiding suspicious websites and links.
- Download Caution: Downloading software only from trusted sources.
- Attachment Scanning: Scanning email attachments before opening.
Trojans on Mobile Devices
- Fake Applications: Installing malicious applications from unknown sources.
- In-app Advertisements: Clicking on malicious advertisements in free applications.
- SMS and MMS: Opening links in suspicious SMS and MMS messages.
- Rooting and Jailbreaking: Increased infection risk through rooting or jailbreaking the device.
Differences Between Trojans and Other Types of Malware
- Trojan vs. Virus: Viruses replicate themselves, while Trojans don’t have this capability.
- Trojan vs. Worm: Worms spread independently through networks, while Trojans require user interaction for infection.
- Trojan vs. Ransomware: Ransomware encrypts data and demands ransom, while Trojans can have various goals including data theft and remote control.
Related Terms
- Malware - broader category of malicious software
- Ransomware - Trojan-Ransom type trojans
- Phishing - main trojan distribution vector
- EDR - detecting and responding to trojans
Explore Our Services
Want to protect your organization against trojans? Check out:
- SOC 24/7 - detecting and blocking trojans
- Incident Response - infection removal
- Security Awareness Training - threat recognition
Trojans are a serious threat to computer and mobile device security. It’s important to be aware of how Trojans work and apply appropriate protection measures to prevent infections and minimize risk.
Frequently asked questions
+ What is a trojan in simple terms?
A trojan (or trojan horse) is malware that disguises itself as legitimate software to trick users into installing or running it. Unlike viruses, trojans don't self-replicate — they rely on social engineering: phishing emails with malicious attachments, fake software downloads, infected installers, malicious browser extensions, drive-by downloads from compromised websites. Once executed, a trojan can do almost anything the user can: steal credentials, install additional malware (including ransomware), open backdoors for remote control, log keystrokes, exfiltrate data, hijack the device for botnet activity. The name comes from the wooden horse the Greeks used to enter Troy — looked harmless, hid attackers.
+ Are a trojan and a Trojan horse the same thing?
Yes. 'Trojan' is the short form of Trojan horse — the full term used, among others, in NIST guidelines. Both words mean a program that looks harmless but has a hidden, malicious function. People also talk about a 'trojan virus', although strictly speaking a trojan is not a virus, because it does not replicate itself.
+ What does a trojan do on a computer?
It depends on its purpose, but the pattern is similar: once launched, a trojan swaps files or adds its own and often pulls in further attacker tools — according to the NIST SP 800-83 guidelines these can include keyloggers and rootkits. Some trojans act as downloaders: the US agency CISA described Emotet, which dropped other malware onto victims' systems, including malware leading to ransomware. Others steal login credentials, open remote access to the device or exploit its resources.
+ What are the main types of trojans?
Eight common categories: (1) **Backdoor trojan** — opens hidden access for the attacker, (2) **RAT (Remote Access Trojan)** — full remote control of the device (DarkComet, NjRAT, AsyncRAT), (3) **Banking trojan** — steals online banking credentials and intercepts transactions (Emotet, TrickBot, Qakbot, IcedID, Zeus historically), (4) **Downloader / dropper** — small initial trojan that downloads and installs further malware, (5) **Infostealer** — exfiltrates passwords, browser data, crypto wallets (RedLine, Lumma, Vidar — exploding in 2024-2026), (6) **Keylogger trojan** — records keystrokes, (7) **DDoS trojan** — turns the device into a botnet client, (8) **Ransomware loader** — drops ransomware payload (often Emotet → TrickBot → Conti chains).
+ What are famous trojan examples?
Five high-impact: (1) **Emotet (2014-2025)** — banking trojan turned into a malware-as-a-service distribution platform; multiple law enforcement disruptions (Jan 2021) and resurgences, (2) **TrickBot (2016-2023)** — banking trojan, became ransomware loader for Conti; sanctioned and partially disrupted in 2022-2023, (3) **Qakbot (2007-2023)** — multi-decade banking trojan, dismantled by FBI Operation Duck Hunt in August 2023, (4) **IcedID** — emerged as Emotet replacement, used for ransomware delivery, (5) **RedLine Stealer (2020-)** — infostealer sold as Malware-as-a-Service, responsible for massive credential leaks; primary ammunition for stuffer attacks in 2024-2026. Modern trend: trojans are no longer about visible damage — they steal credentials silently, then sell access on dark markets to ransomware operators.
+ How do trojans infect computers?
Six common vectors: (1) **Phishing emails** — malicious attachments (Office macros, ISO/LNK files, ZIP, PDF), still the leading vector in 2026, (2) **Drive-by downloads** — compromised or malicious websites exploiting browser vulnerabilities, (3) **Malicious advertising (malvertising)** — ads on legitimate sites redirecting to exploit kits, (4) **Cracked / pirated software** — game cracks, key generators, pirated commercial software bundle trojans, (5) **Software supply chain** — Trojanised installers, poisoned updates (3CX 2023, MOVEit 2023), (6) **Malicious browser extensions** — fake productivity tools or privacy extensions exfiltrating data. AI-generated phishing has substantially raised infection rates in 2024-2026 by eliminating language flaws.
+ How to detect trojans on a computer?
Symptoms of trojan infection: (1) Slow performance, frequent crashes, unexpected reboots, (2) Antivirus disabled or unable to update, (3) Unfamiliar processes in Task Manager (especially with random names), (4) Unexpected network traffic to unknown servers, (5) Browser homepage / search engine changed without consent, (6) Unfamiliar programs in startup, (7) Mouse cursor moves on its own (RAT in use), (8) Banking transactions you didn't authorise. Detection methods: (1) **Modern EDR/XDR** — behavioural analysis catches what signature AV misses, (2) **Sandbox analysis** — submit suspicious files to VirusTotal, Hybrid Analysis, Joe Sandbox, (3) **Memory analysis** — Volatility, Rekall for fileless trojans, (4) **Network monitoring** — Zeek/Suricata flag C2 communication. For enterprise: 24/7 SOC + EDR is the gold standard.
+ How to remove a trojan?
Stepwise approach: (1) **Disconnect from network** to prevent further data exfiltration or lateral movement, (2) **Reboot in Safe Mode** to limit running processes, (3) **Run a full EDR or AV scan** with up-to-date definitions, (4) **Check startup items** (msconfig, Task Scheduler, Services) and remove unfamiliar entries, (5) **Reset browsers** — extensions, homepage, search engine, (6) **Change passwords** for every account accessed from the device — from a clean device, (7) **Monitor financial accounts** for fraudulent activity. **For confirmed serious infection**: complete OS reinstall is the safest option — modern advanced trojans (rootkits, UEFI implants) survive even disk reformat. Enterprise: invoke incident response, image the device for forensics, then re-image clean.
+ How to prevent trojan infections?
Eight controls: (1) **Modern endpoint protection** (NGAV + EDR) on every device — CrowdStrike, Microsoft Defender, SentinelOne, Sophos, (2) **Aggressive patching** — most trojans exploit known CVEs, (3) **Email security gateway** with sandbox detonation and impersonation detection, (4) **Restrict Office macros** — block from internet by default (Microsoft default since 2022), (5) **Application allow-listing** — Windows Defender Application Control, AppLocker, (6) **MFA on every account** — limits damage from stolen credentials, (7) **User awareness training** with phishing simulations and quarterly phishing tests, (8) **Browser hardening** — modern browsers (Edge, Chrome, Firefox) with Site Isolation, Enhanced Safe Browsing, ad blockers (uBlock Origin) reduce drive-by risk. Network-level: DNS filtering (Cloudflare 1.1.1.1 for Families, Quad9, NextDNS, Cisco Umbrella) blocks known C2 domains.