What Is a Trojan Horse?

A Trojan horse, in computing and cybersecurity, is a class of malware that conceals its malicious functionality within software that appears legitimate or benign to the user. Named for the wooden horse of Greek mythology used to smuggle soldiers into Troy, the computing term describes any program that gains access to a system under false pretenses and then executes unauthorized actions once installed. Unlike a virus, a Trojan horse does not self-replicate and does not attach itself to other executable files. Unlike a worm, it does not propagate autonomously across networks. Instead, it depends entirely on the user's willingness to install or execute the deceptive host program, which is why social engineering is the primary mechanism of delivery.

The study of Trojan horses falls within the broader discipline of malware analysis and sits at the intersection of operating system security, network security, and human factors research. Defense against Trojans requires both technical controls, such as code signing and behavioral monitoring, and organizational controls that reduce the likelihood of users executing untrusted software.

Delivery and Execution

Trojan horses reach target systems through a variety of deceptive channels. Common delivery vectors include phishing emails carrying a malicious attachment disguised as a document or invoice, software bundles that include hidden payloads alongside legitimate utilities, and fake updates that prompt users to install what appears to be a required patch. Once the user executes the host program, the Trojan's payload runs with the same operating system privileges as the user account that launched it. Escalation to higher privileges requires an additional exploitation step, either a privilege escalation vulnerability or a second payload designed to request administrator access through a legitimate-looking dialog. The CrowdStrike analysis of Trojan malware types documents how modern Trojans combine the initial deceptive installation with modular payloads that are downloaded after execution, separating the delivery stage from the attack capability.

Types of Trojan Horses

Trojan horses are classified by their post-installation behavior. Backdoor Trojans open a persistent communication channel to an attacker-controlled server, enabling remote command execution and data exfiltration. Downloader Trojans focus on retrieving and installing additional malware, acting as a beachhead for multi-stage attacks. Banker Trojans target financial credentials by intercepting browser sessions, injecting form fields, or capturing screen content during banking transactions. Rootkit Trojans embed themselves in the operating system at a level that hides processes, files, and network connections from standard monitoring tools, extending the attacker's dwell time. Ransom Trojans encrypt the victim's files and demand payment for the decryption key. The Kaspersky threat reference on Trojan viruses provides a structured taxonomy of these categories and describes the behavioral signatures used to detect each type.

Detection and Defense

Behavioral detection has become the primary defense against Trojans because signature-based scanning can be defeated by packing, obfuscation, and frequent payload rotation. Endpoint detection and response platforms monitor process creation, network connections, registry modifications, and file system changes to identify patterns consistent with Trojan activity even when the specific binary is previously unknown. Code signing enforces a minimum level of software provenance by requiring that executables carry a cryptographic certificate from a trusted authority before the operating system will run them. Application allowlisting takes a stricter approach by permitting only pre-approved executables to run regardless of signature. At the network level, DNS filtering and egress traffic analysis detect the command-and-control communication that Trojans require to receive instructions and exfiltrate data. NIST Special Publication 800-83 on malware incident prevention and handling provides guidance on layered defenses applicable to Trojan horse threats in enterprise environments.

Applications

Research and defense work on Trojan horses applies to a range of fields, including:

• Enterprise endpoint security and incident response planning
• Hardware security, where hardware Trojans are inserted into integrated circuits during manufacturing
• Software supply chain integrity verification and code signing infrastructure
• Cyber threat intelligence and malware attribution analysis