What Is Trojan Horse?

A trojan is malicious software disguised as something legitimate, relying on the user to install and run it. It does not self-replicate — the deception is the distribution mechanism.

It remains one of the most productive categories, because it needs no vulnerability. The user is the exploit, and they act with whatever privileges they hold.

The disguises that work now

Fake software updates presented by a web page. Cracked or unlicensed commercial software, which arrives with a payload and whose users expect security warnings and dismiss them.

Pirated media and tools, browser extensions requesting broad permissions, mobile applications outside official stores, and utilities downloaded from search advertising rather than from the vendor.

The development-focused variants

Poisoned packages in dependency registries, which execute during installation with whatever rights the build pipeline holds. Modified development tooling. Malicious repository content presented as a sample or a library.

These are considerably more consequential than a user-level infection, because a build system typically has access to source code, signing material and deployment credentials. See supply chain attack.

Why users install them despite training

Because the alternative is not getting work done. Someone needs a tool their organisation has not provided, needs a file converted, needs software the procurement process would take six weeks to approve.

That makes this partly a provisioning problem. Where an approved software catalogue is comprehensive and fast, the incentive to download from elsewhere falls sharply.

Application control is the decisive measure

If unapproved executables cannot run, the disguise is irrelevant. It is among the most effective endpoint controls available and among the least deployed, because it requires knowing what legitimately runs in your environment.

Audit mode first — recording what would have been blocked — is what makes the rollout survivable, and the resulting inventory is useful in its own right.

Detection, for the ones that get installed

Behavioural signals after execution: an unexpected process establishing persistence, an installer writing to unusual locations, a newly installed application making outbound connections to infrastructure with no history.

Signature detection performs poorly here because the sample is frequently freshly built for the campaign, and the wrapper is a legitimate application.

Mobile and browser variants

Applications outside official stores, and applications inside them that passed review before adding malicious functionality in an update, are the mobile form. Permissions granted at install are what determine the consequence, and users grant them in a single tap.

Browser extensions are the closest desktop equivalent: broad access to every page, granted once, with popular extensions occasionally sold to new owners who add collection afterwards. Managing both through policy — an allowed list rather than user discretion — is the control that scales.

Naming is also worth a note in reporting. Because the term describes disguise rather than capability, calling something a trojan says nothing about what it did once installed — which is the part that determines the response. Recording the capability alongside the category avoids a finding that sounds specific and communicates very little.

Where to start

Run application control in audit mode for a month and look at what would have been blocked. The list is usually both shorter than feared and more alarming than expected.

See supply chain security. GuardsArm delivers managed detection and response.