7 Malware Threats Small Businesses Should Watch For
Malware has changed. The old picture of a virus that announces itself with pop-ups is out of date. Today’s malware is usually quiet, often arrives through something that looks completely normal, and is designed to steal passwords and data or lock up your systems for a ransom.
Here are seven types of malware that small and medium businesses should know about in 2026, how each one gets in, and the practical steps that stop them.
1. Infostealers
Infostealers are built to grab saved passwords, browser cookies, session tokens and other data from a computer and send it to criminals. Stolen session cookies are especially dangerous, because they can let an attacker sign in to email or cloud accounts as you, sometimes without needing your password or MFA code again.
The stolen logins are often sold on to other criminals, who use them for business email compromise, invoice fraud or ransomware attacks weeks later.
What helps: do not let staff save business passwords in the browser; use a proper password manager, use phishing-resistant MFA where you can, and run endpoint protection that watches for suspicious behaviour, not just known files.
2. Fake CAPTCHA “ClickFix” attacks
This is one of the trickiest techniques around. A website shows what looks like a normal “I’m not a robot” check. The instructions then ask you to press a few keys, paste something and press Enter. In reality, you are running a malicious command on your own computer.
Security agencies, including the ASD’s Australian Cyber Security Centre, have warned about ClickFix being used to spread infostealers, often through compromised legitimate websites. Because the victim runs the command themselves, it can slip past some security controls.
What helps: teach staff one simple rule: no legitimate website will ever ask you to copy and paste a command into your computer. Application control and restricting PowerShell for normal users add another layer.
3. Ransomware that steals data first
Modern ransomware rarely just encrypts files. Attackers usually copy your data first, then encrypt your systems, then threaten to publish what they took if you do not pay. Even if you restore from backup, the stolen data is still a problem.
If personal information is involved and the breach is likely to result in serious harm, your business may also have obligations under the Notifiable Data Breaches scheme, which means notifying the OAIC and the people affected.
What helps: tested, separate backups that ransomware cannot reach, MFA everywhere, quick patching, and limiting admin rights. Our article on the difference between malware and ransomware explains how ransomware attacks unfold.
4. Fake software downloads and malicious ads
Criminals buy search ads or build look-alike websites for popular software, such as PDF tools, remote access apps or video meeting software. Someone searches, clicks the top result, and installs a version that has malware bundled in.
What helps: only install software from the vendor’s official site or a managed company portal, and remove local admin rights so staff cannot install whatever they find. An IT provider can push approved apps to everyone automatically.
5. Fileless and “living off the land” attacks
Instead of dropping an obvious malicious program, these attacks use tools already built into Windows, such as PowerShell, to do their work. Some run largely in memory. To a traditional antivirus scanner, it can look like normal admin activity.
What helps: endpoint detection and response (EDR) software that looks for unusual behaviour, plus logging and someone actually watching the alerts. Restricting which users can run scripts also reduces the risk.
6. Malicious browser extensions
Browser extensions can read and change what you see on websites. A harmless-looking extension, or a good one that was sold to a new owner and updated, can capture logins, inject ads or redirect payments.
What helps: limit extensions on business computers to an approved list, and review what is installed. Microsoft Edge and Google Chrome can both be managed centrally to block unapproved extensions.
7. Shape-shifting (polymorphic) malware
Polymorphic malware changes its code each time it spreads, so it looks different to scanners that rely on known signatures. Attackers can also use automation and AI tools to produce new variants quickly.
What helps: security software that judges what a program does, not just what it looks like, combined with application control so only approved programs can run at all.
The common thread: the Essential Eight
You will notice the same defences come up again and again. That is no accident. The ASD’s Essential Eight was designed to block exactly these kinds of attacks:
- Application control
- Patch applications
- Configure Microsoft Office macro settings
- User application hardening
- Restrict administrative privileges
- Patch operating systems
- Multi-factor authentication
- Regular backups
Our Essential Eight checklist for small business breaks each one down into plain-English steps.
If you think you have been infected
- Disconnect the affected computer from the network, but do not turn it off.
- Call your IT provider straight away.
- From a clean device, change passwords for email, banking and key business systems, and sign out of all sessions.
- Report the incident to the ACSC through ReportCyber at cyber.gov.au.
- Check whether personal information was involved and whether the Notifiable Data Breaches scheme applies.
Key takeaways
- Most modern malware is about stealing logins and data, not crashing computers.
- Many attacks rely on tricking people, so short, regular staff training pays off.
- Behaviour-based protection, application control and limited admin rights stop what signature scanning misses.
- Tested backups are your safety net when everything else fails.
Our managed IT security service brings these layers together, with 24/7 monitoring of your protected devices.
Would your business stop today’s malware?
Our free IT Health Check reviews your endpoint protection, admin rights, patching and backups against the threats in this article and gives you a clear plan to close the gaps.
Or call 1300 133 770.
