Malware: what it is and how to avoid fake apps

The program that gets in because you opened the door

In short: malware is any program built to harm you: to steal your passwords and accounts, to spy on you, or to lock your files and demand money. It rarely gets in on its own. Most of the time you install it without knowing: a “helpful” app someone asked you to install on a call, a document from an email, a program downloaded from somewhere other than the official store. The rule that protects you: install only from the official store, and never because someone who contacted you asked.

What is malware

The word comes from “malicious software”. It is the door that stays open after the trick: once phishing, vishing or smishing gets you to take one step, malware is what stays installed afterwards.

A normal program does what it promises. Malware does something else, in the background.
It can sit on a device for months with no visible signs.
It is one of the attack vectors, the doors scammers use to reach you.

The kinds you meet

Infostealer. Takes what you saved in the browser: passwords, cookies, open sessions, sometimes screenshots, files and crypto wallet keys. With a stolen session an attacker can enter your account without the password and without a code.
Remote access trojan (RAT) and spyware. Gives the attacker control of your phone or computer: reads messages, calls, contacts and passwords, watches the screen.
Banking trojan. Imitates your bank’s app or sits on top of it to read your details and codes.
Ransomware. Encrypts your files and demands money to unlock them. More and more often it steals the data first and threatens to publish it.
Loaders and droppers. Get in first and bring others after them.

How it reaches your device

The fake app installed from outside the store. On Android, malware often poses as a system update, a game, an antivirus or a “modded” version of a popular app, and is shared as an APK, an installation file from outside the official store.
The link in an email. A message about a “legal notice”, an invoice or a delivery sends you to a short link that goes through several redirects and installs an infostealer.
The call that gets you to install. A caller “from the bank” asks you to install an app named after the bank “to secure your card”. In August 2026, Malwarebytes described a case where a 13-minute call led to a remote-access trojan and a second program that relays your card’s contactless data in real time to a device held by the attacker.
The attachment or the “cracked” program. .exe, .bat, .zip, .rar or .js files from strangers, or pirated software downloaded from unofficial sites.
The message with a link. A text or a chat message that asks you to download an “APK” file.

What's new in 2026

Europol counted more than 120 active ransomware brands in 2025. Its IOCTA 2026 report, published on 28 April 2026, says attacks kept rising and the money increasingly comes from threatening to release stolen data, not only from encrypting files.
Infostealers feed everything else. Europol describes them as a key enabler of the whole spectrum of attacks in 2025, serving fraudsters, ransomware affiliates and access brokers alike.
Whole networks are being taken down. In May 2025, Microsoft and Europol took down about 2,300 domains of the Lumma infostealer, which had infected more than 394,000 Windows computers in two months. In November 2025, Operation Endgame disrupted the Rhadamanthys infostealer and more than 1,000 servers, with hundreds of thousands of infected computers and millions of stolen credentials.
Reported ransomware losses in the United States passed $32 million in 2025, according to the FBI’s report, not counting business disruption. That is a fraction of the real figure, because many attacks are never reported.
The fake app that helps you lose your card. In August 2026, Malwarebytes, citing Group-IB, described a trojan that relays a card’s contactless data in real time so a criminal can pay or withdraw cash.

The practical conclusion: the loss does not begin with a giant program, but with one installation made by you. That is why the same rule works for all of them: you install nothing because someone who contacted you asked.

Why it works

Trust in familiar names. “Black WhatsApp”, “antivirus”, “system update”, the name of your own bank.
Permissions. An app that asks for “Accessibility” or “device administration” can read the screen and tap for you.
Urgency. “Install now, or you will lose your money.”
Devices that are not updated. A phone without security updates has known holes.
No visible signs. An infostealer shows nothing. You notice only when your account does things you did not do.

How to tell something is wrong

Apps you did not install appear.
The battery drains abnormally fast, or the phone heats up for no reason.
An app asks for Accessibility, messages or device administration without a clear reason.
You receive sign-in notifications or codes you did not request.
Your email or social media account posts or sends messages without you.
The browser has new extensions or the start page has changed.
Files no longer open, or a message appears asking for money.

How to protect yourself

Install only from the official store. Google Play or the App Store, or the bank’s own site for its app. Never install APK files received by text, chat or link.
Install nothing because someone who contacted you asked. Especially “support”, “security” or remote-control apps.
Turn off installing from unknown sources in your phone settings.
Check permissions. A flashlight app does not need messages or Accessibility.
Update your phone and computer. Updates fix the very holes malware uses.
Do not open attachments from strangers, especially .exe, .bat, .zip, .rar and .js files.
Use two-step verification and a password manager. Two-step verification makes a stolen password harder to use, and a manager separate from the browser reduces what an infostealer can take.
Keep backups separate from the device, on a drive or an account that is not permanently connected. Against ransomware they are the only safety net.

What to do if you installed it

Disconnect the device from the internet (airplane mode, Wi-Fi off) to stop data leaving.
Call your bank if you entered card details or opened the banking app after installing. Ask to block the card.
Change passwords from another device, starting with email and the bank. End all active sessions: an infostealer steals open sessions, not only passwords.
On a phone, reset to factory settings. Do not restore a backup directly afterwards, because the malicious program can be inside it.
On a computer, run a full scan with a trusted antivirus and, if unsure, reinstall the system.
With ransomware, do not pay. There is no guarantee you get the files back, and the payment funds the next attack. Keep the evidence and report it.
Report it to the police or your national cybercrime authority, and to your bank.

Do not be embarrassed. The people who make these apps make them look exactly like the real ones.

Frequently asked questions

What does malware mean?

Malware comes from “malicious software” and means any program built to harm: to steal data, to spy or to lock files. Viruses are only one type among them.

Can I catch malware just by opening a website?

Rarely, and usually through software that is not updated. Most of the time you have to take a step: install an app, open a file or grant a permission. That is why what you install and which permissions you give matter.

Can an iPhone not catch malware?

It is harder, because apps come from a single store. But it is not impossible, and fraud by call or message works the same on any phone. Most of the fake-app cases you read about in warnings are for Android.

Is an antivirus enough?

It helps, but it does not replace habits. An antivirus can catch many programs, but it cannot stop you from installing an app yourself at a caller’s request. Updates, two-step verification and attention matter as much.

My computer was encrypted and I am asked for a ransom. What do I do?

Do not pay. Disconnect the computer from the network, keep the message and evidence, report it to the police and your national cybercrime authority, and restore from backups. If you have none, ask a specialist for help before deleting anything.

Sources and further reading

Europol, IOCTA 2026, published 28 April 2026
Microsoft, action against Lumma Stealer, 21 May 2025
Malwarebytes, “New Android malware lets criminals use your bank card in real time”, 13 August 2026, based on Group-IB research
FBI, Internet Crime Report 2025, published April 2026
Where to report: your bank first, then your national cybercrime authority or the police

About the author

Brîndușa Maria, Senior Software Test Analyst, ISTQB® Certified Tester Advanced Level Test Analyst (CTAL-TA). I write about how to recognize online scams. LinkedIn

Note: this article is based on my research and professional experience. I used artificial intelligence tools for drafting and editing.

📢 Share the knowledge, stay safe! 🔒✨ Use the share buttons below and help others stay safe online. The more we know about online scams, the better protected we are! 🚀💙

What is malware? Fake apps, infostealers and ransomware in 2026