What is malware and how do you prevent it?
On this page
Malware is software built to work against you: it steals, spies, locks your files or uses your device to attack others. Updates, backups, built-in security software and care with links keep most of it out. A VPN does not.
It comes in many disguises. A torch app that quietly copies your banking login. A pop-up claiming to be Microsoft that locks your screen until you ring a “technician”. A text about an unpaid toll with a link you almost tapped.
What is malware?
Malware, short for malicious software, is any program built to work against the person whose device it runs on. It reaches phones and tablets as readily as laptops.
The main types of malware
Ransomware encrypts your files and demands payment for the key. It does the most damage to households and small businesses, because paying does not guarantee you get anything back.
Trojans pretend to be something useful, such as a free game, a cracked app or an invoice attachment. Run one, and it opens a door for whoever sent it.
Spyware and keyloggers watch what you do. Keyloggers record every key you press, which is how passwords and card numbers get captured. “Stalkerware” installed by someone with access to your phone belongs here too.
Viruses attach themselves to files and spread when those files are shared. Worms spread across networks on their own, with no help from you; some of the most destructive outbreaks on record were worms.
Rootkits bury themselves deep in the operating system to hide other malware and keep control of the device.
Adware floods you with advertising. It is the least dangerous here, but it often arrives bundled with something worse.
How malware gets in
- Phishing emails and texts with a link or attachment. This is the big one.
- Fake apps and downloads, especially cracked software and apps from outside the official stores.
- Out-of-date software with security holes already fixed in newer versions.
- Malicious ads and compromised websites.
- USB drives of unknown origin.
Can a VPN stop malware?
Mostly no. A VPN encrypts your connection and hides your IP address. It does not scan files, and it will not stop you opening a dodgy attachment.
It helps around the edges. On public Wi-Fi it stops someone on the same network tampering with what you receive. Some VPNs include an ad and tracker blocker, which helps against malicious ads; the table shows which list one on their own websites.
| VPN | Ad and tracker blocker | Checked |
|---|---|---|
 Surfshark | ✓ Listed | 2 Nov 2026 |
 NordVPN | ✓ Listed | 19 Oct 2026 |
 Proton VPN | ✓ Listed | 2 Nov 2026 |
 PrivadoVPN | Not checked | – |
 PureVPN | Not checked | – |
 Intego VPN | Not checked | – |
 CyberGhost | Not checked | – |
 IPVanish | ✓ Listed | 2 Nov 2026 |
 PrivateVPN | Not listed | 2 Nov 2026 |
 ExpressVPN | ✓ Listed | 2 Nov 2026 |
 Windscribe | ✓ Listed | 2 Nov 2026 |
 hide.me | Not checked | – |
 IVPN | Not checked | – |
 Mozilla VPN | Not checked | – |
 Mullvad VPN | Not checked | – |
 Astrill VPN | ✓ Listed | 2 Nov 2026 |
 AdGuard VPN | Not checked | – |
 Mysterium VPN | Not checked | – |
 Private Internet Access | Not checked | – |
As each provider lists them on its own website, on the date shown. "Not checked" means we have not read that provider's list yet.
Treat a blocker as a useful extra, not a replacement for security software.
How to protect yourself
- Keep everything updated. Turn on automatic updates for your operating system, browser and apps. Most infections use holes that already have a fix.
- Use security software. The protection built into Windows and macOS is good. Keep it switched on.
- Back up your files. An external drive or cloud backup turns ransomware from a disaster into an inconvenience. Test that you can restore from it.
- Slow down on links. Check the sender, hover to see where a link really goes, and go to the site directly instead of tapping through.
- Install from official stores and read what permissions an app asks for.
- Use a password manager and two-factor authentication, so one stolen password does not unlock everything.
If you think you are infected
- Disconnect the device from the internet.
- Run a full scan with your security software.
- From a different, clean device, change your email and banking passwords first.
- Call your bank straight away if you entered card or account details anywhere suspicious.
- Report it. In Australia, report cybercrime through ReportCyber at cyber.gov.au and scams to Scamwatch. If your identity documents are exposed, IDCARE offers free support.
FAQ
Can iPhones and Macs get malware?
Yes. It is less common than on Windows and Android, but both are targeted, mainly through phishing and fake apps.
Is free antivirus good enough?
For most people, the security built into current Windows and macOS, kept up to date, is a solid baseline.
Does a VPN protect against hackers?
It protects your connection from snooping, which matters most on public Wi-Fi. It does not protect against malware you install yourself. More in do I need a VPN?
What is the most dangerous type of malware?
For households and small businesses, ransomware: it locks your files, and paying does not guarantee you get them back.