Editing Malware (section)

====Trojan horse====
A Trojan horse misrepresents itself to masquerade as a regular, benign program or utility in order to persuade a victim to install it. A Trojan horse usually carries a hidden destructive function that is activated when the application is started. The term is derived from the [[Ancient Greece|Ancient Greek]] story of the [[Trojan horse]] used to invade the city of [[Troy]] by stealth.<ref>{{Cite conference|last=Landwehr|first=C. E|author2=A. R Bull|author3=J. P McDermott|author4=W. S Choi|year=1993|title=A taxonomy of computer program security flaws, with examples|url=https://apps.dtic.mil/sti/pdfs/ADA465587.pdf|publisher=DTIC Document|archive-url=https://web.archive.org/web/20130408133230/http://www.dtic.mil/cgi-bin/GetTRDoc?AD=ADA465587|archive-date=8 April 2013|access-date=5 April 2012|url-status=live}}</ref><ref>{{Cite web|title=Trojan Horse: [coined By MIT-hacker-turned-NSA-spook Dan Edwards] N.|url=http://www.anvari.org/fortune/Miscellaneous_Collections/291162_trojan-horse-coined-by-mit-hacker-turned-nsa-spook-dan-edwards-n.html|url-status=live|archive-url=https://web.archive.org/web/20170705103553/http://www.anvari.org/fortune/Miscellaneous_Collections/291162_trojan-horse-coined-by-mit-hacker-turned-nsa-spook-dan-edwards-n.html|archive-date=5 July 2017|access-date=5 April 2012}}</ref>

Trojan horses are generally spread by some form of [[Social engineering (security)|social engineering]], for example, where a user is duped into executing an email attachment disguised to be unsuspicious, (e.g., a routine form to be filled in), or by [[drive-by download]]. Although their payload can be anything, many modern forms act as a backdoor, contacting a controller (phoning home) which can then have unauthorized access to the affected computer, potentially installing additional software such as a keylogger to steal confidential information, cryptomining software or adware to generate revenue to the operator of the trojan.<ref>{{cite web|title=What is the difference between viruses, worms, and Trojan horses?|url=http://www.symantec.com/business/support/index?page=content&id=TECH98539|access-date=10 January 2009|publisher=Symantec Corporation|archive-date=13 February 2015|archive-url=https://web.archive.org/web/20150213213523/http://www.symantec.com/business/support/index?page=content&id=TECH98539|url-status=dead}}</ref> While Trojan horses and backdoors are not easily detectable by themselves, computers may appear to run slower, emit more heat or fan noise due to heavy processor or network usage, as may occur when cryptomining software is installed. Cryptominers may limit resource usage and/or only run during idle times in an attempt to evade detection.

Unlike computer viruses and worms, Trojan horses generally do not attempt to inject themselves into other files or otherwise propagate themselves.<ref>{{Cite web|date=9 October 1995|title=VIRUS-L/comp.virus Frequently Asked Questions (FAQ) v2.00 (Question B3: What is a Trojan Horse?)|url=http://www.faqs.org/faqs/computer-virus/faq/|access-date=13 September 2012|archive-date=24 September 2015|archive-url=https://web.archive.org/web/20150924041119/http://www.faqs.org/faqs/computer-virus/faq/|url-status=live}}</ref>

In spring 2017, Mac users were hit by the new version of Proton Remote Access Trojan (RAT)<ref>{{cite web|title=Proton Mac Trojan Has Apple Code Signing Signatures Sold to Customers for $50k|date=14 March 2017|url=http://appleinsider.com/articles/17/03/14/proton-mac-trojan-has-apple-code-signing-signatures-sold-to-customers-for-50k|publisher=AppleInsider|access-date=19 October 2017|archive-date=19 October 2017|archive-url=https://web.archive.org/web/20171019163245/http://appleinsider.com/articles/17/03/14/proton-mac-trojan-has-apple-code-signing-signatures-sold-to-customers-for-50k|url-status=live}}</ref> trained to extract password data from various sources, such as browser auto-fill data, the Mac-OS keychain, and password vaults.<ref>{{cite web|date=24 August 2017|title=Non-Windows Malware|url=https://betanews.com/2017/08/24/non-windows-malware|publisher=Betanews|access-date=19 October 2017|archive-date=20 October 2017|archive-url=https://web.archive.org/web/20171020033721/https://betanews.com/2017/08/24/non-windows-malware/|url-status=live}}</ref>