What Are Trojans?

Trojans are malicious code constructs, in software or hardware, that disguise their harmful functionality within a trusted or expected exterior. In software security, a Trojan is a program that performs unauthorized operations while presenting itself as a legitimate application. In hardware security, a Trojan is a malicious circuit modification inserted into an integrated circuit design during fabrication or the supply chain, one that activates under specific conditions to alter or disable device behavior. Both forms share the defining property of concealment: the malicious element is hidden inside something the target system or its operators have no reason to suspect. The term derives from the wooden horse used to conceal soldiers in the siege of Troy, and has become a standard classification in both software and hardware security taxonomies.

The dual use of the term across software and hardware security communities reflects a common conceptual framework: the attacker gains trust or access first, then exploits that position. The threat models, detection methods, and defensive architectures differ substantially between the two domains, but the core principle of trusted concealment unifies them.

Software Trojans

Software Trojans are malicious programs that rely on social engineering and deceptive packaging to gain execution. A user installs what appears to be a game, a productivity tool, or a software update; the hidden payload then opens a backdoor, downloads additional malware, intercepts credentials, or encrypts the file system. Unlike viruses and worms, software Trojans do not self-propagate; each infection requires the user to execute the deceptive host. Modern software Trojans often use multi-stage architectures in which a lightweight dropper establishes persistence and then retrieves the active payload over an encrypted channel, separating the detectable installation event from the malicious behavior. Behavioral detection, which monitors process activity, network connections, and file modifications in real time, has become the primary technical defense against software Trojans because their obfuscated binaries defeat static signature scanning. The SentinelOne cybersecurity reference on Trojan horse types and prevention provides a taxonomy of software Trojan categories and their behavioral signatures.

Hardware Trojans

Hardware Trojans are unauthorized circuit modifications introduced into an integrated circuit at the design, fabrication, or testing stage of the supply chain. A hardware Trojan typically consists of a trigger circuit, which monitors for a specific rare condition such as a particular input sequence or a cycle counter threshold, and a payload circuit, which executes when the trigger fires. Payloads range from leaking cryptographic key material through a covert timing or power channel to completely disabling a device under field conditions. Hardware Trojans are especially concerning in defense and critical infrastructure applications because the modification is physically embedded in silicon, cannot be patched through software updates, and may lie dormant through years of testing before activating. The difficulty of exhaustive testing at the transistor level, given the billions of gates in a modern system-on-chip, makes pre-deployment detection a research-intensive problem. Work at institutions including DARPA's Trusted Integrated Circuits program has pursued trusted foundry and supply chain assurance approaches to reduce hardware Trojan risk.

Detection Methods

Detection strategies differ by domain. For software Trojans, behavioral analysis, sandbox detonation, and network traffic inspection are the primary tools. Endpoint detection and response platforms collect telemetry across millions of endpoints to identify anomalous patterns linked to known Trojan behaviors. For hardware Trojans, detection approaches include side-channel analysis of power consumption and electromagnetic emissions, functional testing with carefully chosen input patterns, and formal verification against a golden reference design. The IEEE Xplore trusted computing special section documents research advances in both software and hardware Trojan detection as part of the broader trusted computing field.

Applications

Research on Trojans informs a range of security disciplines, including:

• Integrated circuit supply chain assurance and trusted foundry certification
• Endpoint detection and response product development
• Malware analysis and reverse engineering in cyber threat intelligence
• Critical infrastructure protection against hardware-level sabotage