Viruses
Malicious programs that can attach themselves to files or software and spread when infected content is opened or shared.
Tech Learning Hub · Cybersecurity Lesson 04
Malware, Ransomware & Dangerous Downloads
Understand how malicious software reaches computers and phones, how ransomware can disrupt access to important files and how safer download habits can reduce your risk.
← Cybersecurity lessons
Published: October 27, 2026
Last updated: October 27, 2026
The basic idea
Malware is software designed to do something harmful
Malware is short for malicious software. It is a broad term for software intentionally created to damage devices, steal information, spy on users, disrupt operations or provide attackers with unauthorised access.
Malware can affect individuals, businesses and organisations. Computers are common targets, but smartphones, servers and other connected devices can also be attacked.
A malware infection does not always begin with an advanced technical attack. Sometimes it begins because someone downloads a convincing fake application, opens an unexpected attachment or installs software from an untrusted source.
Common categories
Different types of malware have different goals
Trojans
Malware disguised as legitimate or useful software. A person may install it believing they are downloading something safe.
Spyware
Software designed to secretly collect information about a device or its user, such as browsing activity, credentials or other sensitive data.
Ransomware
Malware that can encrypt files or otherwise block access to systems and then demand payment from the victim.
Information stealers
Malware designed to steal information such as saved passwords, browser data, authentication tokens or cryptocurrency wallet information.
Remote-access malware
Malicious software that may allow an attacker to control or monitor an infected device remotely.
Understanding ransomware
Ransomware can turn access to your own files into leverage
Ransomware is malicious software designed to deny access to files or systems, commonly by encrypting data. Attackers then demand payment and claim that paying will restore access.
Modern ransomware incidents may also involve data theft. Attackers can threaten to publish stolen information in addition to encrypting systems.
Paying a ransom does not guarantee that files will be restored, that stolen information will be deleted or that attackers will not target the victim again.
How infections happen
Malware often arrives disguised as something useful or urgent
Malicious email attachments
An unexpected document, archive, installer or other attachment may contain malicious code or lead to malware.
Fake software downloads
Attackers may create fake download pages for popular applications, utilities, games or updates.
Cracked or pirated software
Unofficial copies of paid software may be modified to include malware and usually bypass normal security and update channels.
Fake updates
A website or pop-up may falsely claim that your browser, media player or device requires an urgent update.
Malicious advertising and websites
Deceptive advertisements or compromised websites may redirect visitors to harmful downloads or fraudulent pages.
Untrusted USB drives and removable media
Files or software on unknown removable devices can introduce malware when opened or executed.
Real-world patterns
Dangerous download examples
These examples are educational recreations of common techniques. They are not real download prompts and contain no active links or files.
Dangerous download example — for educational purposes
Fake browser update
Web browsing scam patternYour browser is out of date! Install this critical security update now to continue browsing.
What should make you suspicious?
Browsers normally provide updates through their own built-in update systems or official websites. Do not trust an unexpected webpage simply because it claims an update is urgent.
Dangerous download example — for educational purposes
Free premium software
Pirated software riskDownload the FULL PRO version FREE — activated forever. Antivirus may detect the activator, so disable protection before installation.
What should make you suspicious?
Instructions telling you to disable antivirus or other security protection are a major warning sign. Cracked software is a common way to distribute malicious programs.
Dangerous download example — for educational purposes
Unexpected invoice attachment
Email malware patternPayment overdue. Open Invoice_2026.zip immediately to avoid additional charges.
What should make you suspicious?
Unexpected archives and attachments should be treated cautiously, especially when the message creates urgency or you do not recognise the sender or transaction.
Dangerous download example — for educational purposes
Fake video or document viewer
Malicious download patternThis file cannot be viewed until you install SecureViewer. Click Download to continue.
What should make you suspicious?
Do not install unfamiliar software merely because a website says it is required. Verify the application independently and use trusted official sources.
Dangerous download example — for educational purposes
Game cheat or modification
Gaming malware patternUndetectable game cheat — download now. Turn off Windows Security before opening the loader.
What should make you suspicious?
Tools that require security protection to be disabled create serious risk. Attackers frequently use desirable software, cheats and utilities as bait.
Dangerous download example — for educational purposes
Unknown USB drive
Physical device riskYou find an unidentified USB drive and connect it to your computer to discover who owns it.
What should make you suspicious?
Unknown removable media should not be connected casually to important devices. It may contain malicious files or software.
Recognising ransomware
Warning signs that require immediate attention
- Files suddenly cannot be opened or appear to have unfamiliar extensions.
- A ransom note appears demanding payment to restore access.
- Documents, photos or business files become encrypted or unavailable.
- The desktop background or login screen unexpectedly changes to a payment demand.
- Security tools are unexpectedly disabled or cannot be opened.
- Multiple devices or shared network files begin becoming inaccessible.
Safer downloads
Reduce the chance of installing something dangerous
1
Download software from the developer's official website, trusted app store or another verified source.
2
Avoid cracked, pirated or unofficially modified applications.
3
Do not disable antivirus or security controls simply because an installer tells you to.
4
Keep your operating system, browser and applications updated.
5
Be cautious with unexpected attachments, especially executable files and compressed archives.
6
Check the website address carefully before downloading software.
7
Use reputable security protection and keep it updated.
8
Back up important files so one device failure or ransomware incident does not destroy your only copy.
A download being popular, free or highly ranked in search results does not automatically make it safe.
Verify who created the software and obtain it from an official or trusted distribution source whenever possible.
Backups matter
Keep important files somewhere an attacker cannot easily destroy
Reliable backups can reduce the impact of ransomware, device failure, theft and accidental deletion. Important files should not exist only on one laptop, phone or storage drive.
A strong backup strategy may combine an external backup with a reputable cloud backup or another protected copy. Some backups should be disconnected, offline or otherwise protected from being modified by malware affecting the main device.
Backups are useful only if they can actually be restored. Check them periodically and make sure important files are being copied successfully.
If ransomware is suspected
Focus first on limiting further damage
01
Disconnect the affected device from networks and external storage when it is safe to do so. This may help limit further spread.
02
Do not continue opening files or running unfamiliar programs on the affected device.
03
From a safe device, notify the appropriate IT administrator, security team or trusted technical professional if one is available.
04
Preserve useful evidence such as ransom notes, suspicious emails, filenames and screenshots.
05
Check whether important accounts or credentials may also have been exposed and secure them from a clean device.
06
Report the incident to relevant authorities or cybersecurity reporting services where appropriate.
07
Use clean, verified backups and professional recovery guidance when restoring affected systems.
Do not assume that paying a ransom guarantees recovery.
Ransomware incidents can involve legal, financial, privacy and operational consequences. Businesses and organisations should involve appropriate technical, legal and incident-response professionals.
Trusted resources
Learn more from established cybersecurity organisations
CISA — StopRansomware
Ransomware guidance, prevention information and incident-response resources from the U.S. Cybersecurity and Infrastructure Security Agency.
Visit resource ↗
No More Ransom
An international initiative providing ransomware information and legitimate decryption resources for some known ransomware families.
Visit resource ↗
UK NCSC — Malware and Ransomware
Practical guidance from the UK's National Cyber Security Centre on reducing malware and ransomware risks.
Visit resource ↗
Microsoft Security — Ransomware
Information about ransomware, common attack techniques and ways users and organisations can improve protection.
Visit resource ↗
Key takeaways
Remember these six points
Malware is malicious software designed to harm, spy on, steal from or gain unauthorised access to devices and systems.
Ransomware is a type of malware that can block access to files or systems and demand payment.
Unexpected attachments, fake updates, pirated software and unofficial downloads are common malware delivery methods.
A message telling you to disable security protection before installing something is a serious warning sign.
Official websites, trusted app stores, software updates and reliable backups greatly reduce risk.
If malware or ransomware is suspected, quick isolation and careful incident response can help limit further damage.
Next lesson
Safe Browsing, Wi-Fi & Device Security
Learn practical habits for safer web browsing, wireless networks, software updates and protecting the computers and phones you use every day.
Return to Cybersecurity lessons