How a phishing email turns into malware on your machine

Phishing and malware get written about as two subjects, which hides the fact that for most people they are one event with two halves. A message persuades you to act; the action puts something on your device. Following the sequence end to end makes both halves easier to interrupt, and makes the clean-up less frightening when you get to it.

It starts with a story, not a file

Every one of the FTC’s listed pretexts is a small piece of fiction designed to make opening something feel like the responsible thing to do. They say there has been suspicious activity or a log-in attempt on your account — there hasn’t. They say there is a problem with your account or your payment information — there isn’t. They ask you to confirm personal or financial information — you don’t need to.

Others come dressed as admin rather than alarm: an invoice you do not recognise, a link to make a payment, an offer of a government refund, a coupon for something free. CISA’s contribution is the emotional register to watch for — urgency, and claims of dire consequences if you do not act now.

The click, and the two things it can do

There are two routes from a message to a bad outcome, and they need different defences.

The first is a page that harvests what you type. You land on something that looks like your bank or your employer’s log-in, and you hand over the credential yourself. Encryption on that page proves nothing: the FTC notes that scammers create fake websites and encrypt them to make you think they’re safe, and your data may be encrypted on its way to the site but it won’t be safe from the scammers operating the site.

The second is code. The FTC states it flatly in its list of pretexts: a message may include a link to make a payment, and the link has malware. An attachment does the same job. Neither route requires you to be careless — it requires the story to be plausible for about four seconds.

What the device does afterwards

The FTC’s malware warning signs are worth knowing as a list, because individually each one reads like an ageing computer. Together they read like an infection.

• The device suddenly slows down, crashes, or displays repeated error messages.
• It won’t shut down or restart.
• It won’t let you remove software.
• It serves a lot of pop-ups, or shows ads in places you typically wouldn’t see them, like government websites.
• Unexpected toolbars appear, the default search engine changes, or the home page keeps changing.
• It sends emails you didn’t write.
• It runs out of battery life more quickly than it should.

Getting it off the machine

Step five is not a failure state. It is the documented end of the sequence, and it is why the backup you took before any of this happened matters more than the scanner you run afterwards.

1. Stop doing anything sensitive on the device — no banking, no shopping, no logging into accounts.
2. Get security software if you do not have it.
3. Make sure all your software and your operating system are fully up to date.
4. Run a scan and delete what it finds.
5. If that does not work, recover or reinstall the operating system, following the instructions on the manufacturer’s website.

Three reports, three different places

The FTC keeps these separate, and the separation is deliberate rather than bureaucratic.

• Forward the phishing email to reportphishing@apwg.org.
• Forward a phishing text to SPAM (7726).
• Report the incident itself at ReportFraud.ftc.gov.
• If you gave up a Social Security, credit card or bank account number, go to IdentityTheft.gov for a recovery plan.
• For internet crime more broadly, including ransomware, file with the FBI at IC3.gov.

What realistically prevents the next one

The FTC’s four baseline protections are security software with automatic updates, automatic phone updates, multi-factor authentication, and backups. CISA’s rule for the message itself is the one that does not depend on your judgement of the writing: look up another way to contact the company or person directly, rather than using anything in the message.

For the credential-harvesting route specifically, the #StopRansomware Guide names phishing-resistant MFA, not MFA in general, for email and any account reaching critical systems — because a code you can be talked into reading aloud is a code that can be phished.

Sources: FTC — How to recognize and avoid phishing scams · FTC — How to recognize, remove, and avoid malware · CISA — Recognize and report phishing · CISA — #StopRansomware Guide · FTC — Are public Wi-Fi networks safe?

Reviewed 27 August 2026 by the CyberArtical editorial team against primary guidance from the FTC and CISA. Security guidance changes over time; where our earlier version of this page said something different, we say so in the article rather than editing it out quietly.