Remote-access malware is malicious software built to give an attacker interactive control over an infected computer or server. Unlike a simple dropper or one-time payload, it usually keeps a live channel to a command-and-control system so the operator can issue commands, browse files, start processes, move data, or create additional access paths.
It matters because hands-on control turns a compromise into a flexible intrusion. Attackers can use it for persistence, reconnaissance, lateral movement, and staging other tools while trying to blend in with normal administration traffic. Defenders look for signs such as unusual outbound connections, remote shell behavior, suspicious service creation, and repeated tasking from known infrastructure. Detecting this class of malware often depends on both host telemetry and network intelligence, because the same tool can be repackaged, renamed, or reused across different campaigns.