Your device can become infected with malware by simply browsing the internet

View a list of simple ways you can avoid catching a computer virus

Because this type of malware requires human intervention, such as plugging an infected flash drive into a computer or downloading and running an infected file, the chance of infection can be greatly reduced by being cautious about unfamiliar emails, attachments, and links. Keeping systems up to date with the latest security fixes is also crucial.

Creating malware requires more than knowledge of programming languages

Because computer viruses, worms, and other malicious software reside within a computer's operating system, which manages computer hardware and software, cybercriminals writing effective malicious code must understand how the OS manages input and output, permissions, memory, etc. Knowledge of credentials and network access also helps create malware that easily spreads.

Different types of malware are categorized by how they spread or operate

Computer viruses require user interaction to execute a file and spread, whereas worms can self-replicate across systems without human intervention. Ransomware locks systems until a key is provided, spyware tracks and reports user activity to a third party, and trojans disguise various types of malware as legitimate software.

Computer viruses can slow systems by allocating resources to malicious actions

Once infected software is run, instructions in the malicious code within the program or file can copy the code to various locations, exacerbating the infection and producing additional symptoms, such as slow performance, altered login credentials, changes to device settings, and system crashes.

The history of malware includes computer viruses, worms, trojans, and ransomware

Some of the earliest significant pieces of malware—the Creeper worm and the Elk Cloner virus—displayed silly messages to users without causing major harm. As computer science has advanced, malware has become more easily spread, incorporated social engineering to manipulate users, targeted infrastructure systems, and been used by governments for virtual espionage.

A computer virus is a type of malware that self-replicates and spreads

Spread through emails, downloads, messaging services, and outdated software, viruses attach to programs, self-replicate, and infect other systems. They can delete files, steal data, and cause performance issues as they spread.

Explore demonstrations of hundreds of viruses and other malware in action

On their YouTube channel, Malware historian Daniel White has documented what happens when various types of malware—mostly from the 1980s and 90s—run on a computer or Nokia cell phone. The demonstrations were safely conducted within virtual machines—older operating systems run within contained windows of modern software, resembling a picture-in-picture setup.

Modern antivirus software searches for malicious behavior alongside malicious code

The first viral infections were identified by comparing the computer code of programs and files with a database of known virus codes, a method known as signature detection. The ongoing creation of new malware made databases continuously outdated, leading to the development of systems that detect patterns consistent with known viral activity.

Safely explore historic viruses and other malicious software in the Malware Museum.

Malware has transitioned from notoriety-driven to profit- and data-driven

Many of the first researchers and hobbyists who created viruses and worms showed a natural curiosity in experimenting with and designing such software to make a name for themselves and advance the field of computer science. In the future, AI-augmented malware may adapt in real-time or design enhanced cryptojackers, infostealers, and ransomware for cybercriminals.

The dark web can expose anonymous users to potentially dangerous environments

Browsing the dark web requires onion routing, which prevents visitors from being identified and the locations from which they connect from being traced. This has been useful to activists in environments affected by political oppression or instability. However, those unfamiliar with navigating the space may encounter malware and network attacks from denizen hackers.

The Melissa 'virus' helped associate pornographic sites with computer viruses

A worm-embedded document posted online enticed users to download and open it by alleging to contain passwords to paywalled explicit websites. Upon opening, the worm shared itself with 50 addresses in a user's Outlook contacts, masquerading as a friendly attachment. Its rapid spread overwhelmed email servers and caused $1.1B in damage worldwide.

Many early computer viruses were not created for malicious purposes

Besides those authored in research labs as proofs of concept for self-replicating software, hobbyists would create malware that played music or displayed text and animations that intentionally revealed the infection as a means of showing off, rather than hiding their spread.

Some viruses evade detection by altering their own code or hiding in Microsoft Office

Computer viruses are often classified by how they spread or which files they infect, with the oldest ones—boot sector viruses—targeting systems that are active when a computer is turned on. Macros—custom codes in office productivity programs authored to automate tasks—spawned their own class of viruses.

In 2019, a laptop loaded with six of the worst malware in history and described as 'an exhibit of historical weaponry' sold for $1.3M.

Explaining how open source systems like Linux can be secure, despite their public source code

While no computer system is immune to all cyberattacks and malware, the transparency of open-source technology means many thousands of developers can review and oversee the underlying code powering the software on an ongoing basis. This increases the likelihood of catching and patching vulnerabilities more quickly than smaller groups of cybercriminals looking to exploit them.

Smart cities without strong cybersecurity can leave utilities extremely vulnerable

Insecure devices connected to the Internet of Things pose risks to the entire network, which cybercriminals can hijack to compromise infrastructure and private resident data. Poorly secured systems that become inoperable can undermine the promise of smart cities by worsening the quality of life.

Explore the cost of major viruses and other malware incidents through 2017

The first significant malware was the Morris worm in 1988, which caused an estimated $10,000 to $10M in damage to computers. With $38B in damage caused, Mydoom is the most costly piece of malware in history. Spread via email and, at one point, accounting for about 25% of all messages sent worldwide, the malware infected computers to create a botnet that launched cyberattacks.

Third-party apps are not made by the manufacturer of your device or its operating system but are checked for malware and compatibility before being made available in official app stores, like Google Play.

Watch a guided video tour of the Museum of Malware Art

The site includes installations, sculptures, textiles, musical pieces, and galleries inspired by malicious software and related technologies, including the ILOVEYOU virus, encryption protocols from ransomware attacks, and the Industroyer malware framework used by Russia to cut power to Ukraine.

The ILOVEYOU virus exemplified how social engineering could help spread malware

Displaying as LOVE-LETTER-FOR-YOU.TXT on Windows computers, the file appeared to be a love letter, which many users willingly opened. However, the file contained a script that damaged and hid files, caused Internet Explorer to download software to help steal passwords, and copied itself to all Outlook contacts to continue spreading.

Watch an ethical hacker provide a tour of the dark web

Cybersecurity researcher John Hammond explores the effectiveness of a dark web search engine, leaks from ransomware group data breaches, and a categorized index of dark web links, including some that are alleged to host malware. Many dark web sites are no longer active or host scams to fool unsuspecting visitors.

Through prompt injection attacks, bad actors provide deceptive prompts to generative AI systems in order to manipulate their outputs and acquire sensitive data.

Ads follow you around the internet through technology called 'cookies.'

20 of the most common cyberattacks

While there are dozens of different types of cyber attacks, this article explains the top 20 most common network attack examples, including phishing, whale-phishing, and spear-phishing attacks. Learn how to best protect yourself.

Technical vulnerabilities prevent full-proof anonymity when browsing the dark web

Despite encrypting data and relaying it within the Tor network, traffic between the network exit and the final destination is no longer hidden and can be captured. Law enforcement agencies can also attempt to deanonymize users by monitoring and matching data signal patterns entering and leaving the network via a correlation algorithm.

Credit monitoring services may oversell the benefits of dark web monitoring

Currently, technology exists to scrape and download data from webpages, which can then be analyzed to identify a user's information. However, scrapers cannot access or remove personal data from dark websites because they are often protected by paywalls, rendering monitoring ineffective beyond reporting publicly available data breaches.

Minor technology failures can spiral into massive internet outages

A mix of centralized cloud infrastructure and legacy protocols leaves the internet susceptible to downtime from minor cyberattacks or software bugs, infrastructure damage caused by extreme weather, and human error if a DNS service provider—the internet's phone book—or a backend system, such as Amazon Web Services, were compromised.

Indirect prompt injection is a major security flaw of generative AI systems

These attacks can manipulate AI behavior by hiding instructions in websites and PDFs that become part of training data. The more companies connect sites, services, and sensitive datasets to AI tools, the greater the chances of exposure to malicious code.

Logic bomb viruses can awaken from a dormant phase without human input

Theoretically, computer viruses can remain idle indefinitely while awaiting specific user actions, as instructed by their code. However, logic bombs—embedded code that triggers when specific conditions are met—can automatically execute viruses, such as when a certain date or time is reached.

The dark web cannot be stumbled upon by accident

Many pages on the dark web are not publicly broadcast and are available only to relevant parties on a need-to-know basis. Although some online directories list the URLs for these webpages, connecting to them still requires specialized software, as these pages block connections from traditional web browsers such as Chrome.

How to prepare for cyberattacks

An easy-to-digest checklist on the many ways you want protect yourself from a cyberattack before it happens, if it happens, and after it happens.

Visualizing the growth of botnets

Botnets are a network of computers that have been infected with a variant of malware that coordinates and leverages them for automated mass attacks such as data theft and crashing servers. This interactive map highlights where botnets have been located between 2014-2020.

In 2018, it took about 2.3 years to develop a way to exploit a software bug for malicious purposes, but as of 2026, AI tools have reduced this time to about 20 hours.

Disconnecting from technology can be made easier by turning off notifications, making nonessential apps and devices harder to access, and opting for 'dumb' devices, such as a film camera.

Computer viruses' hijacking abilities led them to be named after biological viruses

Just as their counterparts infect cells and take control of cellular processes to replicate endlessly, computer viruses cannot replicate on their own and must copy their code into host software before duplicating when the program or file is opened. The term "virus" comes from the Latin word for "venom."

How companies track you around the internet, explained

Being able to track how users behave on websites is a massive opportunity for companies to hone their products, target their ads, and more. Dozens of trackers are on the average website you visit, depending on how you deal with that site's cookie policy, and Google is the chief tracker of them all. Learn about these companies and what they are tracking with this informative blog visualization.

A 2020 study suggests just 6.7% of Tor network users visit sites on the dark web

It did not distinguish between visits to malicious sites and traffic to legitimate institutions with .onion domains, such as the BBC or Buzzfeed, and thus claimed that 6.7% of anonymized users engage in nefarious activity. The low percentage still highlights that most users of the technology underlying the dark web do not use it to browse the hidden portion of the internet.

The first computer virus was created by a USC doctoral candidate in 1983

A year after creating malware in a controlled experiment that multiplied until it took over all of a computer's memory, Fred Cohen went public with his research and its risks. He called the self-replicating software a "computer virus," a term Cohen's advisor, Leonard Adleman, coined to describe its infectious behavior. (Some readers may experience a paywall.)

Watch a cybersecurity expert answers questions about hacking

From firewalls and VPNs to ransomware and viruses, IBM Distinguished Engineer Jeff Crume has seen many changes in cybersecurity during his 40 years of IT experience. In this video, he explores some of the most significant hacking events in history and provides advice on protecting yourself online.

Learn how governments around the world restrict internet access for their citizens

Various countries around the world, including China, Russia, and Iran, control their local DNS infrastructure, allowing them to block access to online content by preventing the internet "phone book" from finding the IP addresses for specific URLs. Government-controlled internet service providers can also cut off access entirely or throttle specific traffic.

Trudging through the dark web to expose child abuse

A computer expert who created a system to track down sources of revenge porn and an investigative journalist joined forces to investigate digital abuse. Their investigations focused on so-called clear nets, websites that make up the web most users surf. Then, they turned their investigation toward the dark web, where they found a child abuse website with more than 1 million registered users.

The benefits and risks of smart grids, from improved efficiency to cybersecurity risks

By using a network of devices, including digital meters, sensors, and controllers, smart grids can quickly detect mechanical issues and fluctuations in supply and demand, automatically adjusting electricity flow to prevent cascading failures. While this is important for variable solar and wind power generation, many of these computer systems are designed to be controlled remotely, which increases the risk of malicious access.

The dark web makes up about 0.01% of all the data on the internet

The surface web (5%-10%) consists of indexed sites—those traditional search engines have visited and stored so users can discover them via web search. The remaining 90%-95% makes up the deep web, which is not indexed and includes email and banking portals that require login credentials. The dark web is unindexed and requires anonymizing software to visit.

Fancybear: The state-backed hacker cell

Fancy Bear (APT28) is a Russian-based hacker group that targets a variety of organizations across the globe. Learn how to prevent Fancy Bear.

Explore content on the dark web safely with the Ahmia search engine, which has provided activists with digital addresses to anonymously send files to media outlets.

An overview of the World Wide Web, which is often confused with the internet

When users create a website, they organize content and store it on a web server—one of various types of hardware that make up the internet—in web languages, such as HTML and JavaScript. When visiting the site, a web browser translates these languages into text and other media for consumption.

The internet explained at five levels of difficulty, from protocols to internet flattening

Resembling a roadway with traffic laws that all cars must follow, the internet is the hardware that connects a source to a destination, and these connections must follow specific software rules. Although data had to travel through about 10 networks to reach a destination in the past, data centers increasingly consolidate traffic, just as a highway does for cars, to improve data speeds.

Unlike the models made by large AI companies, open-weight models can have their safeguards removed or weakened, a process that has become increasingly easy and may expose users to harmful information.

Web crawlers and internet archives and back-ups limit perfect erasure of online data

Crawlers are programs that automatically browse the internet for links and index pages for search engines to pull up when page content matches search queries. Networks of global data centers also create copies of content as fail-safes for potential failures to ensure access isn't ever lost.