Malware, and how it actually spreads

Common types

• Virus: attaches itself to legitimate files or programs and spreads when they're shared or run.
• Worm: spreads on its own across a network, without needing a human to run anything.
• Trojan: disguises itself as legitimate software to trick someone into installing it.
• Ransomware: encrypts files and demands payment for the decryption key. Often the most disruptive category for organisations, since it directly hits availability.
• Spyware: quietly monitors activity, keystrokes, or screen content and sends it back to an attacker.

How it actually gets in

In the overwhelming majority of real incidents, malware arrives through one of three doors: an email attachment or link, a compromised or fake website, or an infected USB drive or download. It very rarely "just appears" through some exotic technical route, it's almost always something a person was tricked into opening or installing.