Daniel's question this week is about malware — specifically, what actually separates malware from a virus, what the landscape looks like across different operating systems, and whether malware still matters as an attack vector now that phishing and social engineering have gotten so sophisticated. It's a good question because most people, including a lot of folks who work in tech, use "virus" and "malware" interchangeably. And that linguistic sloppiness hides a real distinction that matters for understanding what's actually attacking your machines.
The distinction is the first thing to clear up, because it's not a subtle one. Malware is the umbrella term — any software intentionally designed to cause harm, disrupt operations, steal data, gain unauthorized access, or act against the user's interests. That's the whole category. A virus is one specific member of that category. It's self-replicating code that attaches itself to a host file or a boot sector, and it spreads when that host gets executed. Think of it like this — malware is the disease, virus is one way the disease spreads.
So every virus is malware, but not every malware is a virus.
A trojan doesn't self-replicate. It sits there disguised as something legitimate and waits for you to run it. A worm self-propagates across networks without needing a host file at all. Ransomware encrypts your data and demands payment. Spyware watches what you do. Rootkits embed themselves deep in the operating system to hide from detection. Keyloggers record your keystrokes. Botnet clients turn your machine into a remote-controlled drone. Infostealers harvest your credentials, session cookies, crypto wallets, autofill data. None of those are viruses in the technical sense, but they're all malware.
And the reason the terminology matters is that the old mental model — the one from the nineties, where you'd catch a virus from a floppy disk and it would infect your files — that model doesn't describe what's actually happening now. Most modern malware isn't viral at all. It doesn't self-replicate. It gets delivered.
Right. The word "virus" stuck around because it was accurate for a long time. In the late eighties and early nineties, file-infecting viruses were the dominant threat. The Morris worm in nineteen eighty-eight was a worm, sure, but the big public fear was viruses — Michelangelo, CIH, Melissa. Melissa was actually a macro virus, and that's a good example of the distinction. It spread inside Word documents, and when you opened the document, the macro would infect your system and email copies of itself to people in your address book. That's viral behavior — self-replicating, file-infecting.
And then at some point the economics shifted, and the self-replicating part became less useful to attackers than the payload part.
That's the key insight. A virus's defining feature is replication. But if you're a criminal trying to steal credentials or encrypt files for ransom, replication is just a delivery mechanism, and it's a noisy one. It draws attention. Modern attackers would rather deliver a trojan once to a targeted machine than have a virus spreading wildly and triggering every antivirus engine on the planet. The shift from viruses to trojans and infostealers is the shift from "spread as far as possible" to "get in quietly and monetize."
So let's talk about what's actually out there across operating systems. Daniel asked about variants on every OS. Where do we start?
Windows is still the biggest target, and it's not close. Market share, legacy attack surface, decades of accumulated software — it's where the most malware gets aimed. But the interesting story of the last few years is macOS. There's been a significant rise in macOS-targeted infostealers. Atomic Stealer is the one that got the most attention — it started showing up in twenty twenty-three and really proliferated through twenty twenty-four and into twenty twenty-five. It's distributed through fake installers for legitimate apps. Fake Zoom installers, fake browser updates, fake productivity tools. You think you're downloading something you need, you run the installer, and it harvests your browser credentials, session cookies, crypto wallets, autofill data.
And the Mac user base has this cultural assumption that they don't need to worry about this stuff.
That assumption was never quite true, but it was closer to true fifteen years ago when the Mac market share was small enough that attackers didn't bother. Now macOS is a significant enough target that there's a whole malware-as-a-service economy around infostealers built for it. The barrier to entry has collapsed. You don't need to write your own malware anymore. You can subscribe to an infostealer on an underground forum, get updates, get a dashboard, get customer support. It's software as a service, just for crime.
Which is a sentence that would have sounded absurd in nineteen ninety-five and now is just... the state of the industry.
It's the professionalization of the whole thing. Infostealers are sold as malware-as-a-service — MaaS, which is a terrible acronym but it's what the security community uses. You pay a subscription fee, you get access to the builder, you get the panel where stolen data shows up, you get updates when the vendor adds new evasion techniques. It's the same model as legitimate SaaS. And the data these things collect feeds directly into account takeover. A session cookie is often worth more than a password, because it bypasses multifactor authentication entirely. The site thinks you're already logged in.
That's the part that I think most people don't grasp. Stealing a password is one thing, but stealing a session cookie means you don't need the password at all. You just present the cookie and the server says, come on in.
And that's the infostealer-to-phishing pipeline. The stolen cookies and credentials get sold in bulk, and then they're used to launch more convincing phishing campaigns. Business email compromise is a big one — you steal the session cookie for someone's corporate email, you get into their inbox, and now you can send phishing emails from their actual account to their actual contacts. The phishing email comes from a trusted source, so the recipient clicks. It's a feedback loop.
Let's talk about Android and iOS before we get deeper into that loop.
Android malware is widespread, and it's mostly delivered through sideloaded APKs. The Google Play Store has its own scanning and vetting, but the moment you allow installation from unknown sources and download an APK from a website or a messaging app, you're outside the walled garden. Malicious apps disguised as cracked games, fake productivity tools, fake cryptocurrency apps — they ask for permissions that seem reasonable, and then they're harvesting your contacts, your messages, your banking sessions. Android's open nature is a feature and a vulnerability at the same time.
And iOS?
iOS is more locked down. Apple's App Store review process and the sandboxing model make it much harder to get malware onto an iPhone through normal channels. But "harder" doesn't mean "impossible." Pegasus is the famous example — the NSO Group spyware that targets iOS via zero-click exploits. Zero-click means the victim doesn't have to tap anything. The exploit chain just needs the phone to receive a message, and the spyware installs itself. That's the highest end of the threat spectrum, the kind of thing aimed at journalists and dissidents and political targets, but it demonstrates that no platform is immune. The attack surface exists. It's just a question of who's willing to pay for the exploit.
Pegasus is a good reminder that "locked down" is a statement about the cost of attack, not the possibility of attack. If someone spends millions of dollars on a zero-click exploit chain, they're not doing it to steal your Netflix password.
Right. The threat model matters. The average iPhone user is not being targeted by Pegasus. But the average iPhone user is absolutely being targeted by phishing pages that try to steal their Apple ID credentials, and those credentials then get used for account takeover, and the account takeover then gets used to lock them out of their own devices or make fraudulent purchases. The malware doesn't have to be on the phone to be effective. The attack can live entirely in the browser.
So that's the landscape. Windows as the big target, macOS infostealers on the rise, Android vulnerable through sideloading, iOS locked down but not immune. Now Daniel's bigger question — is malware still a major exploit, or has phishing taken over?
This is where the question itself is slightly wrong. The dichotomy is false. Phishing and malware aren't competitors. They're stages in the same kill chain. A phishing email delivers a malicious attachment or a link to a malicious site, and that site or attachment installs the malware. The phishing is the delivery mechanism. The malware is the payload. You can't separate them.
It's like asking whether the delivery truck or the package is more important. They're doing different jobs in the same operation.
And the sophistication of modern campaigns is really about using social engineering to bypass technical controls. The fake CAPTCHA pages from twenty twenty-four and twenty twenty-five are a perfect example. You're browsing, a page pops up that looks like a legitimate CAPTCHA verification, and it instructs you to press Windows-R, paste a command, and hit enter. The command runs PowerShell and downloads and executes the malware. The user does it to themselves, thinking they're proving they're human.
That's the part that's clever. The old advice was "don't click suspicious links." This bypasses that entirely. There's no suspicious link. There's a familiar verification ritual, and the user is the one running the command.
And it works because CAPTCHA pages are everywhere. People are trained to complete them without thinking. The attacker exploits a trained reflex. Same with fake browser updates — you see a page that looks like Chrome telling you to update, you click the button, and you've installed an infostealer. The social engineering isn't a trick anymore, it's an exploitation of habit.
So the "just don't click links" advice is obsolete.
It was always insufficient, but now it's actively misleading. Modern malware delivery often requires no click at all, or it uses trusted platforms to host the payload. Malvertising is a good example — malicious ads served through legitimate ad networks that redirect to exploit kits. You don't have to click anything suspicious. You just have to load a page with an ad on it. And attackers host payloads on GitHub, on legitimate cloud services, on compromised but otherwise trustworthy websites. The infrastructure is designed to look clean.
Let's get at the economic core of this. Why is malware still a major exploit? What's the monetization?
Because malware is what makes phishing profitable. A phishing email that tricks someone into typing their password into a fake login page — that's a credential theft, and it works, but it's a one-shot. You get one password. A phishing email that delivers an infostealer gets you every password, every session cookie, every autofill entry, every crypto wallet on that machine, and it keeps harvesting for as long as the malware stays installed. The return on investment is orders of magnitude higher.
So phishing without malware is a mugging. Phishing with malware is a home invasion where the burglar copies your keys, your ID, and your bank statements, and then keeps coming back.
And ransomware is the other big monetization engine. Phishing delivers the initial access, the malware encrypts the data, and then the ransom demand follows. The whole ransomware economy — the double extortion model where they threaten to leak the data if you don't pay — that all depends on malware. Phishing is the front door, but malware is the thing that actually does the damage and generates the revenue.
There's something else here that I think is worth pulling out. The feedback loop. Stolen credentials and session cookies from infostealers feed directly into more convincing phishing. So malware makes phishing better, and phishing makes malware more profitable. It's not just two stages in a chain. It's a cycle.
The business email compromise example is the clearest illustration. Once an attacker has access to a real inbox through stolen session cookies, they can send phishing emails from that inbox to the victim's contacts. The emails come from a real address, with real email history, real signatures, real writing style. The recipient has no reason to be suspicious. The malware that stole the cookie in the first place has now enabled phishing that's nearly indistinguishable from legitimate communication.
And that's the thing that should worry people. The old model of phishing was a badly spelled email from a Nigerian prince. The new model is a message from your boss's actual email account, referencing a project you actually worked on, asking you to review an attached document. The attachment is the malware.
The personalization is the scary part. Infostealers harvest enough data — contacts, emails, documents, browsing history — that attackers can craft phishing messages that reference real events and real people. It's not spray-and-pray anymore. It's targeted, and the targeting data comes from malware.
So where does this leave the question Daniel asked? Is malware still a major exploit? I think the answer is that the question frames it wrong. Malware isn't competing with phishing. It's the thing phishing delivers. And the sophistication of modern phishing is making malware more effective, not less relevant.
The arms race is real. As phishing gets more convincing — and AI-generated phishing is going to make it dramatically more convincing — the malware payloads need to get better at evading detection. Better obfuscation, better anti-analysis techniques, better use of legitimate system tools to avoid looking like malware. The two halves of the attack are co-evolving.
There's also the question of whether security awareness training is keeping up. Most corporate training still treats phishing and malware as separate modules. Here's how to spot a phishing email. Here's how to avoid malware. But if they're stages in the same kill chain, teaching them separately is teaching people to defend against the wrong boundaries.
That's a open question. The kill chain model — delivery, exploitation, installation, command and control, exfiltration — that's been around in security circles for a long time, but it hasn't really trickled down to how we teach regular employees to think about threats. Most people still think in terms of "don't click bad things" rather than "understand the whole sequence of an attack."
And the fake CAPTCHA example shows why that matters. The user who runs that PowerShell command isn't clicking a bad link. They're following instructions that look legitimate. If your mental model is "bad things come from bad links," you're defenseless against an attack that uses a familiar verification ritual as the trigger.
The same goes for the fake browser update. The user thinks they're being responsible. They're updating their browser. That's good security hygiene. And the attacker has turned good security hygiene into an infection vector.
That's the darkest part of all this. The attacks are getting better at exploiting the things we've trained people to do reflexively. Update your software. Complete the CAPTCHA. Verify you're human. These are all reasonable behaviors, and they've all been weaponized.
And the trusted platform angle makes it worse. If the payload is hosted on GitHub, the user sees a GitHub link and thinks, this is a legitimate developer platform. If the malvertising is served through a legitimate ad network, the user sees an ad on a site they trust. The old heuristics — check the URL, look for misspellings, don't trust unknown senders — they're all breaking down.
So we've got a landscape where malware is more professionalized than ever, delivered through increasingly sophisticated social engineering, monetized through infostealers and ransomware, and the old defensive advice is obsolete. What's the actual state of defense?
Defense has gotten better in some ways. Endpoint detection and response tools are good at catching known malware signatures and behavioral patterns. Browsers have gotten better at sandboxing and blocking malicious downloads. Operating systems have gotten better at requiring signed code and limiting what unsigned executables can do. But the attackers are adapting, and the malware-as-a-service model means the adaptation happens faster than it used to.
The asymmetry is the fundamental problem. The defender has to be right every time. The attacker only has to be right once. And now the attacker can rent their toolkit instead of building it, which means more attackers, more attempts, more chances to be right once.
And the data that gets stolen feeds back into making the next attack better. It's a compounding problem. Each successful infostealer infection makes future phishing more convincing, which makes future malware delivery more effective, which steals more data, which makes future phishing even more convincing.
It's a flywheel, not a cycle.
That's exactly the right image. A flywheel that keeps spinning faster.
Let me ask you something. Do you think the average person — not a security professional, just someone with a laptop and a phone — has any real chance of defending against this?
Against the sophisticated end of it, no. Against the broad middle, yes, with caveats. The basics still matter — keep software updated, use a password manager, enable multifactor authentication, don't install software from random websites. But the caveat is that these defenses are probabilistic, not absolute. They reduce risk. They don't eliminate it. And the attacks are engineered to exploit the gaps between what people are trained to do and what's actually safe.
The fake CAPTCHA is the perfect example of that gap. The training says "don't click suspicious links." The attack doesn't use a suspicious link. The training says "be careful what you download." The attack makes you download it yourself by running a command. The training is always one step behind.
Which is why I think the more useful mental model is to think about what you're protecting and what's worth protecting. If you have a machine with nothing valuable on it, the stakes are lower. If you have a machine with your email, your bank accounts, your crypto, your work documents — that machine is a target, and the attacker only needs to find one gap.
The other thing I keep thinking about is the asymmetry of attention. The attacker can study your habits, your software, your defenses, and craft an attack specifically for you. The defender has to guard against every possible attack. It's not a fair fight, and it's getting less fair.
And the malware-as-a-service economy means the attackers don't even need to be skilled. They can be opportunistic. They can buy a subscription to an infostealer and start harvesting credentials without understanding how the malware works internally. The skill floor has dropped, which means the volume of attacks has risen, which means the probability of finding a gap has risen.
The industrialization of crime.
That's what it is. The same forces that made legitimate software easier to build and distribute have made malicious software easier to build and distribute. The underground forums have their own marketplaces, their own review systems, their own customer support. It's a shadow industry.
And it's not going away. The economic incentives are too strong. As long as stolen credentials can be monetized, infostealers will exist. As long as ransomware payments can be extorted, ransomware will exist. The malware is the engine that turns social engineering into revenue.
Which brings us back to Daniel's question. Is malware still a major exploit? The answer is yes, and the reason is that malware is the thing that makes the exploit profitable. Phishing gets the foot in the door. Malware cleans out the house. And the two are so tightly coupled now that treating them as separate threats is a category error.
What's the single biggest misconception here? I think it's the idea that "virus" and "malware" are the same thing, and the related idea that if you're not seeing virus-like behavior — files corrupting, systems crashing — you're not infected. Modern malware is quiet. An infostealer doesn't announce itself. It sits there harvesting your session cookies and sending them to a server in the background. You might never know it was there.
The correction is that a virus is one specific type of malware, and most modern malware isn't viral at all. It's trojans and infostealers and ransomware and botnet clients — designed to be quiet, designed to monetize, designed to evade detection. The old mental model of a virus as something that visibly wrecks your machine is exactly wrong for the current threat landscape.
Hilbert: The nineties were different.
Oh?
Hilbert: I worked the abuse desk at a small ISP for about eight months in ninety-seven. My job was reading email headers and quarantining messages with suspicious attachments. We had one Windows 95 machine in the office, and a macro virus took it down for three days. Came in through a Word document someone opened. It emailed itself to everyone in the office address book before we pulled the network cable.
You saw the viral era firsthand.
Hilbert: We called them viruses because they were viruses. Self-replicating, file-infecting. The term wasn't wrong back then. It's just that the malware changed. The trojans and infostealers came later, and that's when "malware" became the better word. But in ninety-seven, if you said "malware," people looked at you like you'd made up a word.
That's a fair correction. The terminology shifted because the threat shifted, not because people were wrong to call viruses viruses.
Hilbert: I still have a floppy disk from that incident. Labeled "DO NOT RUN" in black marker. It's got the macro virus on it. I kept it as a souvenir.
Did you ever run it?
Hilbert: No. I lent it to a coworker once. He ran it. His machine was fine, but I got written up for unauthorized distribution of potentially hazardous materials. Still think that was unfair. I didn't distribute it. He asked to borrow it.
You handed him a floppy disk labeled "DO NOT RUN" and he ran it?
Hilbert: He was curious.
That's the human factor in a nutshell. Label something "DO NOT RUN" and someone will run it.
Hilbert: The write-up said I should have refused to share it. But he was a grown man. He knew what the label said. Not my fault he didn't believe it.
The curiosity impulse is exactly what modern social engineering exploits. The fake CAPTCHA, the fake browser update — they're all designed to make you act before you think. Your coworker saw "DO NOT RUN" and his first thought was, what happens if I run it?
Hilbert: He said he wanted to see what it did. It didn't do anything, as far as we could tell. The machine booted fine. Either the virus didn't survive on the floppy or he didn't actually execute the infected file. But I still got the write-up.
There's a lesson in there about the difference between the thing itself and the fear of the thing. The floppy disk became a hazard not because of what it did, but because of what it represented.
Hilbert: The IT manager was new. Wanted to show he was taking security seriously. I was the easiest target.
The security theater angle. The write-up didn't make anything safer. It just created a record of someone being punished.
Hilbert: That's about right. Anyway, the point is the word wasn't wrong. The malware changed.
Now we're in a world where the malware is quiet and the delivery is loud. The floppy disk era was the opposite — the delivery was physical and obvious, and the malware announced itself by crashing your machine.
The shift from visibility to invisibility is the whole story. A virus in ninety-seven was a spectacle. An infostealer in twenty twenty-six is a ghost. It sits in the background, harvesting quietly, and you never know it was there until your bank account gets drained or your email starts sending phishing messages to your contacts.
Hilbert: I don't miss the abuse desk. Reading email headers all day. People would call in furious that their machine was infected, and half the time it wasn't infected at all. It was just slow because they had forty toolbars installed.
The toolbar era. I'd almost forgotten.
Hilbert: I hadn't.
The toolbars were adware, technically. Malware in the broad sense, even if they weren't malicious in the way a virus was. They were designed to generate ad revenue, not to destroy data. But they were still acting against the user's interests.
Hilbert: They were acting against everyone's interests. Slowed every machine to a crawl and made the browser unusable. I'd rather deal with a macro virus than forty toolbars.
That's a real preference. A macro virus you can remove. Forty toolbars and you're reinstalling the operating system.
Hilbert: We did a lot of reinstalls. That was the other half of the job. Format the drive, reinstall Windows 95, reinstall Office, hope the user had backups. They never had backups.
The backup problem hasn't changed either. People still don't back up, and ransomware still exploits that. The only thing that's changed is the scale.
Hilbert: Ransomware would have been a nightmare in ninety-seven. Half our users didn't know what a file was. They'd have paid the ransom just to make the popup go away.
The popup being the entire user interface for the attack. That's actually a good point — ransomware works because it's visible. It announces itself. It has to, because the whole business model depends on the victim knowing they've been hit and knowing how to pay.
Which is the opposite of the infostealer model. The infostealer wants to be invisible. The ransomware wants to be seen. Different monetization strategies, different visibility profiles, same underlying category.
Hilbert: The macro virus was visible too, I suppose. It made the machine slow, sent emails to everyone, crashed Word a few times. You knew something was wrong. You just didn't know what.
Now you don't know either. That's the trade-off. The malware got better at hiding, and the user got worse at detecting.
Hilbert: I should get going. I've got a box of old floppies to sort through.
Still have the "DO NOT RUN" one?
Hilbert: Somewhere. Not sure which box.
If you find it, don't lend it to anyone.
Hilbert: I learned that lesson.
The open question I keep circling back to is whether security awareness training should stop treating phishing and malware as separate categories. If they're stages in the same kill chain, teaching them separately is teaching people to defend against the wrong boundaries. The fake CAPTCHA attack doesn't fit neatly into either box — it's social engineering that delivers malware, and the user is the one running the command. What module does that go in?
The AI angle makes it more urgent. As AI-generated phishing gets more convincing — better language, better personalization, better mimicry of real writing styles — the malware payloads it delivers will need to evolve to evade detection. The arms race isn't slowing down. It's accelerating.
Malware isn't going away. It's just changing clothes. The question is whether our mental models are keeping up with the wardrobe change.
Thanks to Hilbert Flumingtop for producing.
This has been My Weird Prompts.
If you liked the show, leave us a review wherever you listen.
We'll be back soon.
