Trojan horse (computing)

Did You Know?

• The term was popularized by Ken Thompson in his 1983 Turing Award lecture 'Reflections on Trusting Trust'.
• A simple example of a trojan is a malicious version of the Linux ls command that deletes the user's home directory.
• The origin of the computing concept and term is unclear, but the first Unix manual from 1971 assumed readers knew both.

Behavior

Once a trojan is installed, it can carry out various harmful activities. Many of them reach out to one or more Command and Control (C2) servers online and wait for orders. Because each trojan often uses a fixed set of ports for this contact, spotting them can be fairly straightforward. Other malicious programs may also hijack the trojan and use it as a proxy for their own attacks. In German-speaking countries, government-made or government-used spyware is sometimes called govware, which is mainly meant to intercept communications from the target device. Switzerland and Germany, for instance, have laws that regulate this kind of software. Known examples include the Swiss MiniPanzer and MegaPanzer, and the German state trojan nicknamed R2D2. German govware operates by exploiting security holes that are not publicly known and by accessing smartphone data before it gets encrypted by other apps. Trojans are growing more common because botnets are popular among hackers and because advertising services often let authors violate user privacy. A BitDefender survey from early 2009 reported that trojan-type malware made up 83% of all malware found worldwide. The same company stated that about 15% of computers belong to a botnet, usually after a trojan infection. Recent studies have also shown trojan-horse methods being used against cloud computing systems. In such attacks, a harmful application or service is inserted into the cloud, and when the system mistakes it for legitimate, it can alter or stop cloud functions, causing damage and infection.

Classifications of trojan horses

Trojans are grouped by what they do. Banking trojans, like Zeus and TrickBot, target financial data such as login details, card numbers, or crypto wallet keys. Remote access trojans (RATs) give attackers complete control over a machine, letting them add software, view files, or watch activity. Downloader trojans act as a first step, pulling in other malware like ransomware or spyware. Information stealers quietly grab browser cookies, saved passwords, or documents. Fake antivirus trojans pose as real security tools to push fake payments. Because trojans can blend functions—mixing backdoors, spyware, and downloaders—they remain one of the most widespread malware types.

Modern developments and detection techniques

Modern trojan horses have changed beyond traditional file-based malware, using techniques to avoid signature-based security tools. Fileless malware operates mainly in system memory and relies on legitimate administrative tools like PowerShell or Windows Management Instrumentation (WMI), making detection harder. Trojans have expanded to mobile and embedded platforms; Android trojans are often distributed through unofficial app stores or phishing campaigns. Trojans targeting Internet of Things (IoT) devices exploit weak authentication or unpatched firmware, allowing compromised devices to be used in botnets for distributed denial-of-service (DDoS) attacks. To counter these developments, modern security systems increasingly rely on behavior-based detection techniques, monitoring system activity for signs such as unauthorized privilege escalation or suspicious network communication. Machine learning–based methods have been developed to classify and detect trojans by identifying irregularities in system and network telemetry data, though they present challenges related to false positives and clarity of automated decision-making.

Notable examples

There have been many well-known trojans in cybersecurity history. An early example is the AIDS trojan from 1989, considered one of the first forms of ransomware, as it encrypted filenames and demanded payment. The You Are An Idiot trojan, developed in 2002, originated from a comedy sketch by American radio personality Rick Dees on his 1984 album. The audio was sampled for the YouAreAnIdiot.org website, which functioned as a browser-based trojan displaying flashing black-and-white smiley faces while looping the vocal track. It became a legendary pop-up bomb, spawning six new windows each time a user attempted to close one and disabling standard hotkeys. While it did not cause permanent file damage, it frequently exhausted system resources and caused computers to freeze. The Zeus trojan, first identified in 2007, targeted Microsoft Windows systems to steal banking credentials through man-in-the-browser attacks. In 2015 in Ukraine, an attacker group used a remote access trojan to gain access to a controller server, resulting in an electricity outage for 80,000 people. In 2016, the MEMZ trojan became recognized for its complex and destructive payloads, displaying unusual visual effects and rendering systems unusable. In 2022, a Chinese RAT called Alchimist targeted Windows, macOS and Linux, able to remotely execute actions and capture screenshots. Another trojan, Cloud9, used a malicious Chrome browser extension to steal online accounts.