Malicious code disguised as, or contained within, software that looks legitimate. It can install hidden software to gain access to the users’ systems, usually to steal data or cause data loss.