Malware: The most dangerous gap often sits in front of the screen
The Federal Office for Cybersecurity debunks widespread myths. Usually, an email or a visit to a website is not enough on its own – it becomes dangerous when people are lured into the wrong action.
A computer that suddenly runs slowly, a strange browser extension or an alleged virus warning: situations like these quickly trigger alarm. But not every technical glitch is malware. And not every dangerous attack begins with a spectacular hack.
The Federal Office for Cybersecurity, BACS for short, is currently reporting increased indications of targeted malware attacks. Until the end of 2023, BACS was called the National Cyber Security Centre (NCSC). For private households, the most important takeaway from the current reports is undramatic but highly practical: the most dangerous vulnerability is often not an invisible attack, but a request to do something yourself.
Opening something is usually not enough on its own
Many people believe that merely opening an email, a WhatsApp message or a website automatically leads to an infection. On updated devices, that is generally not the case. Modern operating systems, browsers and security features make it difficult for attackers to install arbitrary programs without any action by the user.
That does not mean, however, that every message is harmless. Criminals often try to push people into a specific action: opening an attachment, carrying out an alleged security check, switching off a protective function or copying a command into the command line.
BACS is observing so-called ClickFix attacks, for example. A notice then appears on a compromised or deceptively genuine website claiming that a technical problem has to be fixed. Anyone who follows the steps shown executes the malicious command themselves, trusting in an apparent repair.
Exceptions remain possible
There are also technical attacks that do not require the user's active consent. These include vulnerabilities in operating systems, browsers or programs. Particularly dangerous are previously unknown weaknesses, so-called zero days.
BACS nevertheless describes such cases as rare and usually targeted. They affect politically exposed individuals, employees of international organisations or diplomats rather than the average private household. For the wider population, a sober rule therefore makes more sense than fear: install updates and stay suspicious when you are asked to act.
A Mac is not immune either
Another myth holds that macOS is fundamentally protected against malware. Apple does build in important protective mechanisms. But they do not make a Mac invulnerable. Programs for macOS also exist that steal login credentials, conduct surveillance, encrypt files or take remote control of a device.
The same applies to smartphones, routers, cameras and other networked devices in the home. Outdated software, default passwords and unnecessarily open access points increase the risk. A compromised router, for instance, can affect other devices in the home network.
Antivirus protection remains useful, but it replaces neither updates nor careful behaviour. It does not detect every new piece of malware immediately, and it cannot stop a person from carrying out a risky action themselves under a false pretext.
Reading warning signs correctly
An infection is often hard to spot. Possible indications include inexplicable changes to browser or system settings, new extensions, unusual redirects, high system load, unknown logins to online accounts or encrypted files.
None of these signs proves an attack on its own. A slow computer can also be struggling because of a full hard drive or memory, a faulty update or old hardware. But several unusual indications at once should be taken seriously.
Particular caution is called for with pop-ups that claim the device is infected and display a phone number. BACS regularly classifies such notices as fake support fraud. Anyone who calls that number may be the first to open the door to the attackers.
What counts after a justified suspicion
If there is a concrete suspicion, BACS recommends having the device examined by a specialist. If malicious programs are confirmed, deleting individual files is often not enough. The system should be completely reinstalled. Afterwards, the passwords for email, e-banking, social networks and other online accounts must be changed.
With business devices, the IT department must be brought in immediately. For smartphones, BACS recommends a factory reset. Preparation is also crucial: automatic updates, backups, separate strong passwords, two-factor authentication and downloads only from trustworthy sources.
Cybersecurity is therefore less a question of perfect technology than of a stable routine. Anyone who does not follow every request, keeps their devices up to date and prepares for an emergency significantly lowers the risk.
Sources
- BACS: Week 40 – Myths about malware: https://www.bacs.admin.ch/de/26w40-de
- BACS: Week 39 – How malware gets onto devices: https://www.bacs.admin.ch/de/26w39-de
- BACS: Malware and concrete measures: https://www.bacs.admin.ch/de/schadsoftware
- BACS: Half-year report 2026/1: https://www.bacs.admin.ch/de/hjb-26-de1
- BACS: The NCSC is now a federal office: https://www.bacs.admin.ch/de/start-bacs-de
