Computer Trojans: Why the Oldest Deception Still Works

The computing trojan takes its name from an ancient myth because it preserves a remarkably stable structure: something appears legitimate, useful or desirable; it is accepted; only after entry does it reveal its concealed purpose. Technology changes, but the principle remains recognisable.

In cybersecurity, a trojan is a type of malware that attempts to appear harmless or trustworthy. Unlike a virus or worm, it does not necessarily spread by itself: it often depends on someone downloading, opening or installing it. Microsoft defines a trojan as a threat that tries to appear legitimate in order to persuade users to accept it. This dependence on human action makes it less like a force breaking through a door and more like an object invited inside.

Why the name comes from the Trojan Horse

In the myth, the Horse does not cross the walls by force. The Trojans draw it into the city. The deception works because the threat is contained within a form compatible with the victim’s desire: the war appears to be over, the enemy seems to have withdrawn, and the object can be interpreted as a gift, a trophy or a religious sign.

The digital trojan repeats this logic. A file may present itself as a document, update, application, attachment, archive or useful program. The visible surface promises one function; the concealed content prepares another. MITRE ATT&CK describes masquerading as manipulating the name, location or appearance of an object so that it appears legitimate or benign to users and security tools.

The metaphor is accurate because the problem is not only code. It is the credibility of form. Malware must appear plausible enough to cross both a technical and a mental threshold.

A trojan is not simply a virus

In everyday language, ‘virus’ is often used for any harmful software. Technically, however, the categories are not identical. A virus is designed to replicate by inserting its code into other files or programs. A worm may propagate autonomously through networks and systems. A trojan concentrates on deceptive presentation and execution obtained through trust, error or involuntary cooperation.

This does not mean that a trojan performs only one function. Once executed, it may download further malware, steal credentials, record keystrokes, exfiltrate data, alter the system, open a backdoor or allow remote control of the device. Microsoft notes that trojans may operate as downloaders, theft tools, access mechanisms or platforms for further compromise.

The word therefore describes primarily the way the threat enters or presents itself, rather than a single final effect.

The decisive threshold is user action

Many attacks depend on what security frameworks call user execution. MITRE ATT&CK includes a specific technique for malicious files that require users to open them. A document may use a common extension, a credible icon, a name consistent with the recipient’s work, or text designed to create urgency.

The user is not merely ‘careless’. The message often constructs a scene that looks normal: an invoice, an internal communication, a CV, a shared file, a security warning or an update. The attack succeeds because it uses real habits and recognisable contexts.

This is where cybersecurity meets social engineering. The malicious code is preceded by a narrative: open immediately, verify a payment, confirm access, read a document, install an update. Like Sinon in the myth, the message assigns a reassuring or urgent meaning to the object.

Phishing, attachments and links

Trojans are frequently distributed through phishing or spearphishing campaigns. A message persuades the recipient to open an attachment or follow a link. CISA has described families such as Emotet and TrickBot as advanced trojans primarily spread through malicious emails, attachments and links.

Generic phishing relies on volume. Spearphishing seeks precision: the text, apparent sender and content are adapted to the target. The more relevant the context appears, the less the object feels foreign.

The attack does not always require perfect imitation. A plausible coincidence may be sufficient: a familiar name, a logo, a deadline, a subject already present in the victim’s activity. The malicious object presents itself as part of the ordinary flow.

Masquerading is not only about a file name

MITRE uses the term masquerading for techniques that make files, services, activities or resources appear legitimate. An executable may use the name of a familiar application; a file may be placed in a credible directory; an extension may be hidden; an icon may suggest a PDF or document.

Similarity acts at several levels. There is graphic, semantic and contextual similarity. The name must appear correct, the appearance familiar and the moment appropriate. The attacker constructs a small digital scenography.

For this reason, the trojan is also a design problem. The object’s surface organises user behaviour. Colours, icons, names, text and pathways become instruments of persuasion.

What it can do after entry

After execution, a trojan may perform very different functions. Some search for credentials and financial information. Others install additional components. Remote access trojans allow an attacker to control a compromised system. Others prepare the ground for ransomware, espionage or lateral movement within a network.

CISA has described Emotet as modular malware capable of functioning as a downloader or dropper for additional threats. TrickBot has been associated with spearphishing campaigns and with theft, reconnaissance and further compromise. These examples show that a trojan may be the first environment of an attack rather than its final outcome.

The contents concealed within the digital ‘belly’ may therefore change. What remains constant is access obtained through an acceptable form.

The trojan in a chain of trust

Digital trust does not depend only on the final user. It depends on vendors, updates, signatures, repositories, app stores and distribution systems. A software supply-chain attack may manipulate code, update mechanisms or packages before they reach the user. MITRE ATT&CK treats software supply-chain compromise as a specific access technique.

In such cases the object does not appear legitimate merely because it imitates a trusted source: it may genuinely arrive through a normally trusted channel that has already been compromised. The Trojan Horse metaphor expands. The city does not simply welcome a well-disguised object; it receives something carrying apparently valid provenance, credentials and routes of entry.

This makes the problem harder because trust cannot be eliminated. Digital systems depend on delegation and dependency. Security must therefore continue to verify what, until that moment, appeared trustworthy.

Why the oldest deception still works

The trojan continues to work because it exploits a necessity. Users must open files, install programs, follow links, share documents and trust infrastructures they cannot inspect completely. A completely closed system would be unusable; a completely open system would be vulnerable.

The attack occupies the space between these needs. It does not invent trust; it uses it. It does not create the desire for efficiency, speed or recognition; it intercepts it. The file is opened because it promises to complete an activity that already exists.

The threat is therefore most effective when it appears as continuity rather than interruption. The best trojan does not look extraordinary. It looks normal.

Reducing risk without turning everything into suspicion

Defence cannot rely only on the generic instruction to ‘be careful’. It requires several layers: regular updates, endpoint protection, email filtering, multifactor authentication, least privilege, backups, network segmentation and training built around realistic situations.

It is useful to verify the actual sender, question unexpected requests, inspect file extensions, avoid software from unofficial sources and never disable protection merely to run a file. Within an organisation, the ability to report a suspicious message quickly matters as much as the ability to identify it.

Effective training does not blame the user. It shows how credibility is constructed. It explains that urgency, authority, familiarity and fear are design materials used by an attacker.

From the wooden Horse to the digital envelope

The myth allows cybersecurity to be seen as a spatial problem. There is an outside and an inside, a threshold, an envelope, concealed contents and a decision to grant access. The trojan is a minimal architecture of deception.

Its surface must be legible as harmless; its interior must remain invisible until the useful moment; passage must occur through consent or an authorised process. The form contains not only code, but an organisation of trust.

In The Trojan Horse — Atlas of a Beautiful Lie, the Horse is explored as machine, architecture, city, symbol and relic. The computing trojan demonstrates how productive that structure remains. The object changes material, yet preserves the relationship between appearance, threshold and hidden programme.

The decisive question is not only ‘is it false?’

In digital culture, the problem is not simply distinguishing true from false. We need to understand what makes an object credible, what desire it intercepts, what authority it imitates and what action it requests.

The Trojan Horse does not succeed because it is perfectly realistic. It succeeds because it arrives when the city wants to believe the siege is over. In the same way, the digital trojan enters when its promise coincides with an expectation: a file to open, a payment to check, an update to install.

The oldest deception still works because it does not depend on a particular technology. It depends on the way we construct trust around the objects we decide to welcome.