Worm-like capability describes malware behavior that can spread with limited human help. It may scan for reachable systems, reuse stolen credentials, exploit exposed services, or copy itself through shared infrastructure such as containers, file shares, or remote management interfaces. The malware does not need to be a classic worm to be described this way; the key idea is that propagation is at least partly automated.
This matters because self-spreading code can turn one compromise into many very quickly, increasing blast radius and making containment harder. Defenders should watch for repeated outbound connection attempts, sudden creation of new processes or containers, image pulls, lateral movement, and unusual use of orchestration or admin APIs. Strong authentication, network segmentation, patching, and restricting management surfaces reduce the chance that worm-like behavior can move across an environment.