What is Trojan?

The name describes the delivery trick, not the payload. NIST's glossary defines a Trojan horse as a program that appears to have a useful function but also has a hidden and potentially malicious one. That split is why the label works better as a delivery category than as a malware family: the same disguised installer can drop ransomware, an information stealer or a remote access tool, depending on what the operator wants. Antivirus detection names such as Trojan:Win32/... reflect this. They describe how the file behaves on arrival, not what it does a week later.

Because the user launches it, a Trojan needs a convincing lure more than an exploit. The usual ones are:

• search ads and lookalike download sites for popular free software,
• fake browser or meeting-app updates pushed from compromised websites,
• pirated software bundles,
• and email attachments dressed up as invoices or shipping notices, often an ISO, ZIP or OneNote file wrapping a script or executable.

MITRE ATT&CK maps the moment of execution to User Execution: Malicious File (T1204.002). The disguise itself is Masquerading (T1036): a double extension like invoice.pdf.exe, a borrowed icon, or a binary named after a Windows process but running from the wrong folder.

Most current samples in this category are droppers or loaders. The first stage is small and does little beyond checking that it is not inside a sandbox, setting up persistence and fetching the real payload over HTTPS. That staging is good news for defenders: catching the loader stops whatever would have come next, and a loader seen on one host is a strong hint that the same campaign reached other users through the same lure.