A malicious program is software installed or run on a system to perform harmful or unauthorized actions. It may steal information, disrupt services, give an attacker remote access, or alter system settings. The term covers many kinds of malware, including viruses, trojans, and ransomware.
In cyber incidents, finding a malicious program can trigger containment measures such as isolating or shutting down affected systems. Its presence does not by itself establish how many systems were compromised, what data was accessed, or whether the program spread. Defenders investigate system images, logs, and other evidence to determine its behavior and scope, then remove it, address the access path, and verify systems before restoring service.