What Are Trojan Horses?

Trojan horses are a category of malicious software programs that masquerade as legitimate or desirable applications in order to gain execution on a target system. The term is borrowed from the Greek myth of the wooden horse used to smuggle soldiers inside the walls of Troy, and it captures the essential mechanism: the deception occurs before the attack, not during it. Once a user installs or executes the disguised program, the hidden payload activates and carries out unauthorized actions such as opening remote access channels, stealing credentials, encrypting files, or downloading additional malware. Trojan horses do not self-replicate or spread autonomously; every infection depends on a deliberate act by the targeted user, which places social engineering at the center of Trojan horse attack chains.

Trojan horses sit within the broader taxonomy of malware alongside viruses, worms, ransomware, and spyware. Their distinguishing characteristic is the combination of a plausible outer identity, a utility, game, document, or software update, with a concealed inner payload that pursues objectives set by the attacker rather than the user.

Delivery Mechanisms

Trojan horses reach victims through channels that exploit trust: phishing emails with attachments that appear to be invoices or shipping notifications, drive-by downloads from compromised websites, software bundles that include hidden components alongside an advertised free utility, and typosquatting sites that offer near-identical copies of popular software with a malicious payload inserted. In enterprise environments, attackers also deliver Trojans through spear-phishing campaigns targeted at individuals with elevated access, tailoring the deception to the recipient's role and organization. The malicious component is often packed or obfuscated to evade signature-based detection at the point of download, with the actual payload retrieved in a second stage after initial execution. The Fortinet resource on Trojan horse viruses and malware describes the common delivery vectors and the social engineering techniques used to make the initial deception convincing.

Payload Types and Capabilities

The payloads carried by Trojan horses range from simple file deleters to sophisticated, modular agent frameworks. Backdoor Trojans establish persistent command-and-control connections that allow attackers to issue commands, transfer files, and pivot to other systems in the network. Banking Trojans intercept browser communications to steal financial credentials and sometimes inject fraudulent transactions into banking sessions. Dropper and downloader variants exist only to retrieve and install secondary payloads, separating the initial delivery from the actual attack capability and complicating attribution. Rootkit Trojans embed themselves below the operating system's normal visibility level to hide processes, registry entries, and network activity. The Proofpoint threat reference on Trojan horse malware catalogs these payload categories along with detection indicators used in enterprise threat intelligence operations.

Detection and Mitigation

Because Trojan horses frequently use obfuscation and code packing to defeat static signature scanning, behavioral detection is the most reliable defensive layer. Endpoint detection and response platforms track process genealogy, network connection establishment, and file system modifications to identify sequences consistent with Trojan activity. At the network perimeter, DNS filtering blocks communication with known command-and-control infrastructure. Application allowlisting prevents execution of any program not explicitly approved, removing the attack surface that delivery-based deception depends on. NIST SP 800-83 on malware incident prevention and handling for desktops and laptops provides a structured framework for building defenses against Trojan horses and other malware categories in organizational settings.

Applications

Trojan horses appear in a range of adversarial operations and security research contexts, including:

• Cyber espionage campaigns targeting government, defense, and critical infrastructure networks
• Financial fraud operations using banking Trojans to steal credentials and authorize fraudulent transfers
• Ransomware deployment, where a Trojan dropper installs the ransomware payload after initial access is established
• Hardware Trojan research examining malicious logic inserted into integrated circuits during fabrication