Security: suspicious behavior, malware basics, and safer everyday computing

Suspicious behavior rarely announces itself as "attack." It usually shows up as small oddities: a message that feels slightly off, a page that asks for one more detail than you'd expect, an alert about a login you don't remember. None of these is proof of danger on its own — that's exactly what makes them useful. Attackers rely on you dismissing the small signals, so learning to notice them, and to weigh them calmly, is most of the game.

The same behavior can be harmless or not depending on context. A "new device signed in" email might be your sibling borrowing your laptop — or a real break-in. The difference is whether the event fits what you already know: did I do this, did I tell anyone, did I recently travel or get a new phone? Context is what separates weird from dangerous, and it's always cheaper to check with the person than to assume.

A practical rule of thumb: react to patterns, not single events. One odd pop-up is probably nothing; the same oddity across three sites, or oddity plus urgency plus a stranger's request, is a pattern worth investigating. The cards below are signs that are worth a second look.

None of these means "you've been hacked." They mean "pause and verify." That single habit — pausing before you act — blocks most real incidents, because most attacks depend on you acting quickly.

Phishing is the oldest trick in online security, and it still works because it targets you, not the machine. A phishing message is designed to make you do something — click, open, reply, pay — before you think. The details vary; the structure doesn't: a reason to act, a reason to hurry, and a path that feels easy.

The sender address is where most of these expose themselves. It's not enough that the display name says "your bank"; the actual address is what matters, and it's often a misspelled domain, a random string, or a free email domain where an institution would never write from. Hover or long-press to see the real destination before you tap anything.

Urgency and fear are the engine: "your account will be closed in 24 hours," "unusual sign-in, confirm now." Real organisations can wait for you to check; attackers can't afford for you to think. Unexpected attachments and requests for money, gift cards, or one-time codes are the highest-risk content in any message.

Red flags to look for

• A sender address that doesn't exactly match the organisation's known domain
• Urgency, threats, or "act now" pressure
• Requests for money, gift cards, passwords, or one-time codes
• Links that go somewhere other than the organisation's real site
• Unexpected attachments — especially .exe, .zip, or documents with macros
• A generic greeting ("Dear customer") when you have an account with them

Investigating it safely

1. Don't click anything in the message first.
2. Go to the organisation's site the way you always do, or call the number on the back of your card — never the number in the message.
3. Check whether the same alert appears in the organisation's official app or site.
4. If in doubt, report or delete it — reporting helps the next person.

A fake login page looks like the real site and asks for the same details, but it belongs to someone else. You can't always tell from the layout, because it's copied. What you can check is the address, the behavior, and the context — and that's where the fakes usually fall apart.

Read the domain, not the brand. The part after the last dot in the address is the actual site you're on. A page reading "yourbank.com.login-verify.net" is a different owner from "yourbank.com" — same words, different hands. Typos, extra hyphens, and unfamiliar endings are the usual giveaways.

The padlock and HTTPS are necessary but not sufficient. They mean the connection is encrypted, not that the site is who it claims to be — fake pages use valid certificates too. Treat the padlock as "this channel is private," never as "this site is trustworthy." And context matters: a login you didn't ask for, a site that redirected you from an ad, or a "session expired" page mid-transaction are all reasons to stop and re-enter the address yourself.

If anything is off, don't type anything. Close the tab, go to the site the way you always do, and only then log in.

Social engineering is the art of getting a person to do something against their own interest, and it works because it borrows everyday human reactions: we help people in a hurry, we defer to authority, we don't want to be the one who broke the rules. The attacker's job is to trigger one of those reactions before you have time to check.

The tactics repeat. Urgency ("do this now"), authority ("I'm from IT / your bank"), fear ("your account is doomed"), curiosity ("look at this"), reward ("you won something"), and pressure to skip normal procedure. Recognising the tactic is what gives you the pause you need.

The universal countermeasure is the same for all of them: slow down and verify through a separate, trusted channel. The person who needs you to act fast is exactly the person who doesn't want you to check — and a legitimate request will confirm itself in seconds.

Notice the pattern: every tactic trades your time for your information. Buying back the time — a pause, a callback, a second channel — defuses almost all of them.

When something looks off, the worst responses are the two extremes: panic (wipe everything, assume the worst) and dismissal (it's probably fine, carry on). The useful response is a short, calm sequence that costs minutes and covers the realistic range. You don't need to know exactly what happened to start it — you need to stop the thing that might be happening.

The first rule is to protect your credentials. If a message or page might have captured a password or a code, treat that credential as exposed: change it from a device you trust, and turn on multi-factor authentication if it isn't already on. Changing a password from the same device or browser that showed the suspicious page can hand the new password to the same attacker.

Contain, then investigate. If a device looks actively compromised, disconnect it from the network so anything on it can't reach the outside. Then, from a clean device, work through the list below. Preserve what you can — a screenshot of the message, the sender, the URL — because it helps you, and the people you report it to, understand what you saw.

1. Stop. Don't click anything else in the message or on the page.
2. Don't provide credentials or codes to anything you can't independently verify.
3. Verify through a separate trusted channel — type the address, call the known number.
4. Disconnect the affected device from the network if it looks actively compromised.
5. Preserve useful information: screenshot the message, copy the sender and URL.
6. Scan the device with your trusted security software.
7. Change any possibly-exposed credentials — from a clean device.
8. Report and monitor — tell the organisation or provider, and keep an eye on your accounts.

1. Stop - don't click anything else in the message or page.
2. Don't provide credentials or codes you can't verify independently.
3. Verify through a separate trusted channel (type the address, call the known number).
4. Disconnect the affected device from the network if it looks compromised.
5. Preserve what you saw: screenshot the message, copy the sender and URL.
6. Scan the device with your trusted security software.
7. Change any possibly-exposed credentials - from a clean device.
8. Report it and keep an eye on your accounts.

"Malware" is an umbrella term for software whose purpose is to cause you harm or to act without your informed consent. Unlike a normal program that does one job you asked for, malware is designed to hide what it's doing and to keep doing it. That combination — unwanted action plus concealment — is what separates it from a buggy or poorly-behaved app.

What it can affect runs wider than "slow computer." Depending on the type, malicious software can read or modify your files, capture what you type, watch your accounts, sell your attention to advertisers, lock your files until you pay, or simply make the device unusable. Some of it targets your data, some your money, some the device itself.

The useful reframe: malware isn't a mystery force, it's software with a goal. Once you understand the goal — steal credentials, extort money, harvest data, rent your device for attacks — the "why is my computer doing that" questions become answerable, and the defences (updates, backups, safe downloads) start to make sense as responses to specific goals rather than vague warnings.

The things it can affect, in one line each: files (modified, locked, or deleted), accounts (credentials and sessions), privacy (what you type, see, and upload), performance (CPU, memory, network), and availability (the device working at all).

The categories exist because malware behaves in different ways, and the behavior tells you what to worry about. A virus and a ransomware have very different goals and very different responses, so knowing which is which changes what you do. None of these require you to understand how they're built — only what they tend to do.

A way to hold them in your head: some are about spreading (viruses, worms), some about hiding and waiting (trojans, rootkits), some about watching or stealing (spyware, keyloggers, adware), and some about taking control for ransom (ransomware). The table compares them on the three things that matter to you: how they arrive, what they do, and what you might notice.

Two practical notes. Real infections often combine types — a trojan that drops a keylogger is common — so treat the categories as a map, not a strict box. And the response to most of them overlaps: isolate, scan from a trusted state, restore from backup where files were touched, and close the door it came in through.

Malware needs a route in, and the routes are the same handful every time. Understanding them is the whole of prevention, because each route has a specific, simple countermeasure. You don't need to block every path perfectly — you need to make the common ones hard enough that the lazy attacks (which are most of them) fail.

The classic routes are a malicious attachment you open, a download from an unsafe source, a compromised or malvertising website, pirated or modified software, a fake update that looks official, removable media from unknown sources, a compromised account used to push malware to you or your contacts, and — the big one — social engineering, where you're simply talked into installing it.

Notice that most of these come down to two behaviors: where you get software, and whether you pause before running something unexpected. Secure those two and you close the majority of real-world infections. The table pairs each route with its specific countermeasure.

Malware tries to be quiet, but it often leaves traces: extra pop-ups, a browser that changed its homepage, a new program you don't remember installing, the fan spinning up when you're doing nothing. None of these is proof of an infection by itself — they're reasons to look closer, the way a new noise in a car is a reason to check, not a reason to panic.

The most useful signs are the ones that combine. A single odd pop-up is probably adware or nothing. But a browser that's been changed, plus unusual network activity, plus a security feature that's now off, is a combination that deserves a real investigation. Context and combination are what separate "something's a bit odd" from "this needs action."

A crucial caution: individual symptoms have many innocent explanations. High CPU is often just a heavy app or a failing drive (see the performance guide); a slow machine is often a full disk or an overdue update. Jumping straight to "I have malware" can send you down the wrong path. Treat signs as prompts to check, not verdicts.

If signs combine or persist, move to what to do if you suspect malware. If it's a single, explainable oddity, note it and keep going.

Security software is a set of overlapping defences, not a single magic shield. Antivirus and anti-malware scan for known and suspicious behavior; real-time protection watches files as they're created or opened; quarantine moves something dangerous out of the way without deleting it; a firewall controls what can talk in and out; browser protections and reputation systems warn you before you reach a known-bad site or file.

The key is to understand what these tools can and can't do. They're very good at stopping the known and the common — the mass attacks that target thousands of people — because they can share signatures and reputation data. They're weaker against brand-new malware aimed specifically at you, and they can't protect you from a credential you willingly type into a fake page. No product, at any price, provides perfect protection.

So treat security software as one layer in a set, not the whole set. It's a strong layer — keep it updated and running — but it works best alongside the behaviors in this guide: safe downloads, current software, strong credentials, and backups. A machine with excellent antivirus and no other habits is still vulnerable; a careful user with basic protection is usually fine.

The response has a logic: first stop it from spreading or doing more damage, then find out what you're dealing with, then restore and close the entry point. The exact steps depend on how serious the signs are, so the first job is to grade the situation honestly rather than react at maximum or minimum.

Low-risk signs — a few odd pop-ups, one unknown program, a browser that changed — are usually handled on your own: update your security software, run a full scan from a normal state, remove what it finds, and reset the browser if needed. If a scan finds and quarantines something and the signs clear, you've likely handled it.

Higher-risk signs change the plan. If files have been encrypted with a ransom note, if you're sure a credential was captured, if security software has been disabled, or if the behavior is advanced and recurring — stop interacting with sensitive accounts, disconnect the device, and get outside help from a trusted professional or the relevant organisation. Some situations, especially ransomware and confirmed account compromise, are not DIY, and pretending they are costs more than getting help.

Two rules apply across the board. Change any possibly-exposed passwords from a known-clean device, never from the affected one. And if your files were touched, your backup is what makes this a nuisance instead of a disaster — restore from it rather than paying or hoping.

A password's job is to be hard to guess and impossible to reuse against you. Two properties do most of the work: length and uniqueness. A long password you use for one service is strong even if you could remember it; a short clever one you use everywhere is weak, because one leak becomes many.

This is why password reuse is the single biggest credential risk. If you use the same password on a large service and a small one, and the small one is breached, an attacker tries that password on the large one — and it works. Every account you share a password with is an account you've effectively given away the moment any one of them falls.

The practical system is a password manager. You remember one strong master password; the manager generates and stores a long, unique password for every other account and fills them in for you. A passphrase — several random words strung together — is an easy-to-type way to get length without gibberish. Set up account recovery (an alternate email, a phone, recovery codes) so a forgotten password is an annoyance, not a lockout.

• Use a long, unique password (or passphrase) for every important account
• Let a password manager generate and store them
• Treat one strong master password as the only one you must remember
• Turn on account recovery so you're never locked out
• Change a password when you have reason to believe it's exposed — not on a calendar

Multi-factor authentication (MFA) adds a second check on top of your password: something you have (your phone, a key) instead of only something you know. Its value is direct — if an attacker gets your password, they still can't get in without the second factor. That's why it's the single most effective account protection available to ordinary users.

The methods differ in strength, and it's worth knowing how. Authenticator apps generate a code on your device and are a good default. Security keys and passkeys are stronger, because they resist phishing — they won't hand over a code to a fake page. SMS codes are better than nothing but weaker, because a phone number can be targeted or ported; use them only where nothing better is offered.

Set up MFA on the accounts that matter most — email first, because it's the key to resetting everything else — and store your backup or recovery codes somewhere safe and offline. If you lose your phone, those codes are how you get back in. MFA isn't a reason to skip a good password; it's a second lock on a door that already has a good one.

Updates exist for a reason, and a large share of them are security fixes for holes that are, by the time they're patched, already being used. An unpatched system is a known target: the people who find a flaw don't keep it to themselves, and the window between a flaw being found and your system being patched is the window you're exposed in.

The updates that matter most are the operating system, your browser, and anything that handles the outside world — email, file transfer, document apps. Browsers are a front line in particular, because a malicious web page is one of the few ways software can reach you without you installing anything. Firmware (the software inside your hardware) and major application updates matter too, just less urgently day to day.

Turn automatic updates on where you can — that's the difference between "patched within days" and "patched whenever I remember" — and then handle the two things automation misses: restarts (many updates only apply on reboot) and unsupported software. A system or app the vendor no longer updates has no more security fixes coming; at that point the choice is to replace it or accept the risk knowingly. For Windows-specific update and recovery issues, the Windows guide goes deeper.

What to keep current: the operating system; your browser and its updates; apps that handle email, files, and documents; device firmware; and your security software's definitions. And: restart when told, and plan to replace software that's no longer supported.

The browser is where the outside world meets your device, and most download problems start with a page that looks like it's offering something useful. The habit that prevents most of them is simple: before you install anything, be able to name the source and say why you trust it. If you can't, don't.

Misleading download buttons are the classic trap — a bright "Download" that's actually an ad, a "free version" that's a different bundled program, or a file whose extension isn't what the page claims. Checking the actual file type (the ending of the name) and the actual destination before you run anything catches most of these.

Browser warnings deserve a straight answer: when the browser or your OS says a site or file is unsafe, believe it and leave — you can almost always get the same thing from the official source. And be deliberate about permissions (camera, microphone, location, notifications), because a permission you grant to the wrong site is a door you've left open.

Email is still the main delivery mechanism for malware, and the rule is unglamorous but effective: an unexpected file is a file you don't open until you've checked it. "Just to see what it is" is exactly the action the attachment is waiting for. The cost of checking is seconds; the cost of not checking can be your files or your account.

The risk differs by type. Executables run code the moment you open them, so an unexpected one is the most dangerous thing in an email. Documents can carry content that runs when opened (macros in a Word document, for example). Archives hide whatever's inside until you extract them. Links go wherever they point. Each has a safer way to handle it.

The safe pattern is the same for all of them: verify before you open. Did you expect this file, from this person? If the answer isn't a clear yes, ask the sender through a different channel, or get the file from a source you trust. The same applies to cloud-storage invitations and shared links — you don't owe a stranger's "shared folder" a look.

Public networks — cafés, airports, hotels, shared computers — are convenient and, honestly, less dangerous than their reputation suggests, because most traffic you care about (banking, email) is now encrypted. But they are shared and untrusted, so the right posture is "be a bit more careful," not "assume you're compromised" and not "ignore it entirely."

The habits that matter: keep your device updated (so you're not the easy target on a shared network), use HTTPS sites (the padlock means your traffic to that site is encrypted end to end), and avoid sensitive actions — logging into banking, entering passwords — on shared or borrowed computers, where a keylogger or a shoulder is a real possibility. Log out of everything on a shared machine.

A few specifics. Don't let your device auto-join open networks you don't recognise — turn off automatic Wi-Fi connections if you travel a lot. A personal mobile hotspot is a reasonable "trusted network" when you need to do something sensitive away from home. And be aware of Bluetooth: leave it off in crowded, public places unless you're using it, since it's a short-range way for devices to find each other. None of this requires paranoia; it's just not doing the sensitive things on the least-trusted surfaces.

A backup is the difference between a security incident being a disaster and being an afternoon. Ransomware, a failing drive, an accidental deletion, a botched update — the response to all of them is the same if you have a good backup: restore. That's why backups are a security measure, not just a convenience; they're the one control that works even when every other control fails. The hardware guide covers the storage side in depth.

The important word is "good." A backup that lives on the same machine as the files it's backing up can be encrypted or deleted along with them. A backup you've never tested might not actually restore. The properties that make a backup trustworthy are: it's somewhere separate (an external drive or a cloud service), it has versions (so you can go back to a point before something went wrong), and — critically — you've actually restored from it at least once to prove it works.

A simple, robust pattern is the "3-2-1" idea: three copies of your important data, on two different types of storage, with one copy off-site. Keep at least one copy that's not always connected, because a disconnected backup is one a network-based threat can't reach. Then test a restore occasionally — restoring one or two files is a five-minute check that turns "I hope it works" into "it works."

A new device is the one time you get to set everything up the safe way from the start, before the habits that make it insecure have a chance to form. It takes an hour, and it puts the machine in a state most older devices never reach. Work through it once, and it becomes your template for any device you set up.

The order matters a little: get it updated and protected first (so everything you add after is added to a safe base), then secure the accounts and the way in (passwords, MFA, lock screen), then set up the safety net (backups, recovery) so that if something goes wrong later, you have a way back.

The goal here is to learn what something is without giving it the chance to do anything. You can do a great deal of inspection with zero risk, because the risk only starts when you execute a file or submit information to a page. As long as you're looking, not acting, you're safe.

For a link: look at the destination before you go. On a desktop, hovering shows the real address; on a phone, long-pressing the link reveals it without opening it. Read the domain carefully (the part after the last dot) and compare it to the organisation's real one. If the message and the link don't line up, that's your answer.

For a file: check the type, not just the name. The extension is the truth — a file called "invoice.pdf.exe" is an executable wearing a document's name. Right-click (or long-press) to see the file type and, where available, the details. You can also scan a file you've saved but not opened — scanning is safe; opening is the risk. And the verification that beats all the inspection: ask, through a different channel. A legitimate sender will confirm in seconds; a fake one can't.

1. Don't open or run it yet.
2. For a link, reveal the real destination (hover / long-press) and read the domain.
3. For a file, check the real file type (the extension) and its properties.
4. Use your built-in warnings — if the OS or browser flags it, stop there.
5. Scan a saved-but-unopened file with your security software.
6. Verify with the supposed sender through a separate, trusted channel.
7. Only then decide — and when in doubt, don't open it; delete or report it.

A periodic checkup catches the slow drift that individual habits miss: the password you reused, the MFA you never set up, the browser extension you forgot, the backup that silently stopped. It's not about finding a crisis; it's about noticing the small gaps while they're still small. Twenty minutes, a few times a year, keeps a lot of future problems from existing.

Work through the list below. It covers the surfaces that matter — your accounts, your credentials, your software, your browser, your devices, and your recovery options. Tick each as you go; the progress is saved in your browser so you can finish it later.

Security that depends on remembering to do a big review once a year is security that fails in the gaps. The durable version is a small routine — a few minutes here and there — so that the important things happen by rhythm instead of willpower. The point is consistency, not volume; a short routine you actually keep beats a thorough one you abandon.

The shape of a good routine is frequency-matched to risk: the things that change daily (a suspicious message, a pop-up) get daily attention; the things that drift slowly (updates, permissions) get a weekly or monthly pass; the things that matter most (backups, recovery) get a periodic, deliberate check. You're not doing more security; you're spreading the same security across time so none of it lapses.

Keep it honest — a routine that becomes busywork gets dropped. Each item below is chosen because it catches a real, common problem, and each takes minutes. If an item never finds anything for a long time, that's the routine working, not the routine failing.

Daily - glance at email, messages and pop-ups for anything odd.
Weekly - let updates finish; restart if one is pending.
Monthly - review accounts and MFA; check browser extensions.
Quarterly - confirm the backup ran, and test a restore.
As offered - act on security-update and security notifications.

To bring it together, here's a complete, realistic incident — fictional, but built from the parts that actually happen. Read it as a story first, then as a procedure. The value is in seeing the whole sequence in one place, because in a real moment you want the order of actions to be automatic.

The situation: you're at your desk when an email arrives from "your bank," subject "Urgent: verify your card to avoid suspension," with a link. You've had a couple of odd login alerts from that bank this week that you assumed were mistakes. As you're reading, a pop-up appears claiming your computer has a serious problem and showing a phone number. Your heart rate goes up a little. Here's what actually happens next, in order.

1. What happened (and what it probably is). Two separate things: a likely phishing email, and a likely fake "tech support" pop-up. They may be unrelated, or the pop-up may be adware that arrived separately. The login alerts add a third possibility — that your bank account is being probed. You don't need to know which is which to start; you need to stop interacting.
2. Immediately: stop and don't act. Don't click the link, don't open the pop-up, don't call the number it shows, don't reply to the email. Close the pop-up (not via its own buttons if you can avoid it) and leave the email unread. This is the single most valuable move — it stops the thing that might be happening.
3. What not to do. Don't change your password from this computer or browser yet. Don't pay anyone or "verify" anything through the message. Don't assume the worst and wipe your machine. Don't assume the best and ignore it. Both extremes are wrong; the middle is a checklist.
4. Contain. Because of the login alerts, treat your bank credential as possibly exposed. Disconnect this computer from the network (Wi-Fi off) so anything on it can't reach your accounts. If you use this computer for the bank, that's the device to contain.
5. Secure your accounts — from a clean device. On your phone (or another trusted computer), go to the bank the normal way (the app, or the address you type yourself). Check the sign-in history for the odd alerts. Change your online-banking password from there, and make sure MFA is on. If the bank shows activity you don't recognise, tell the bank now, through the app or the number on your card.
6. Check the device. Reconnect the computer, update your security software, and run a full scan. The pop-up is likely adware or a scam; the scan will tell you if anything actually installed. Remove anything it finds, and reset the browser if its settings look wrong. If the scan finds nothing and the behavior stops, you've probably handled it.
7. Recover and confirm. Keep an eye on the bank account for a few days. If the pop-up was just a rogue ad, it'll be gone after the scan and a browser reset. If signs return or the account shows problems you can't explain, that's the point to get outside help — a trusted professional, or the bank's fraud team — rather than pushing on alone.
8. Prevent the next one. This incident had three entry points, and each has a fix: phishing (verify before you click — T2, T20), the pop-up (safe browsing and current software — T15, T14), and the credential risk (MFA and a password manager — T12, T13). Do those, and the same attack next time finds nothing to grab.

STOP - don't click, call, or "verify" anything from the suspicious source.
CONTAIN - disconnect the affected device from the network.
SECURE - from a clean device, check the account, change the password, confirm MFA.
REPORT - tell the organisation (bank, provider) through its real channel.
CHECK - update security software, run a full scan, remove what it finds.
WATCH - monitor the account for a few days.
PREVENT - MFA, a password manager, current software, safe-download habits.

Notice what the procedure never required: guessing what exactly happened, or doing anything dramatic. It required stopping, containing, verifying from a clean surface, and closing the specific doors that were open. That's the whole of incident response for an ordinary user, and it's the same shape whether the incident is a phishing email, a pop-up, or a worse day.