Trojan horse

A trojan horse is a type of malware that disguises itself as legitimate or useful software in order to trick the user into running it, giving the attacker unauthorised access to their system.

The name comes from the wooden horse the Greeks used to get inside the city of Troy.

In security terms, a trojan is a tool attackers use to compromise systems and then do whatever they came for: steal confidential information, install further software, damage files, or hold the machine open for later.

Trojans are distributed through phishing email, malicious websites, pirated software downloads and fake messages on social platforms.

Once the user runs or installs the infected file, the malware activates and starts operating on the compromised system.

They tend to work quietly, and can sit on a system for a long time without being noticed. That is the design goal, not an accident.

The main types

Trojans are classified by what they do once they are in, and the categories overlap in practice because one payload usually fetches another.

Spyware. Built to watch the user: logging keystrokes, capturing credentials, taking screenshots or collecting personal data.

Backdoor. Gives the attacker remote access to the infected system, so they can run commands, take data or move further into the network without being seen.

Ransomware. Some trojans exist to deliver ransomware that encrypts the files on the compromised system and demands payment to restore access.

Why the category still matters

The word describes the delivery method, not the payload, and that is exactly why it is useful. A trojan does not exploit a vulnerability: it exploits a decision. The user was persuaded to run it.

That means patching does not help, and the controls that do are the ones that constrain what an executable is allowed to do once it runs: application allowlisting, least privilege, and detection based on behaviour rather than on the file itself.

Where to read more

“What is a trojan horse?”, Norton: what a trojan is, how it works and how to protect against this class of malware.

“What is a trojan horse?”, CrowdStrike: the different types, how they are distributed, and how to detect and remove them.