How to Tell If a Business Device May Have Malware - and What to Do Next

Malware is a broad term for malicious software. It can steal credentials, spy on activity, create remote access, damage files or become the first step in a larger incident such as ransomware.

There is no single symptom that proves a device is infected, but unusual behaviour deserves investigation rather than guesswork.

Warning signs worth taking seriously

• Unexpected pop-ups, browser redirects or new toolbars/extensions.
• Security software being disabled without explanation.
• Unknown applications, processes or scheduled tasks appearing.
• A device suddenly becoming unusually slow, hot or busy when little work is happening.
• Unexplained network activity or repeated account sign-in alerts.
• Files being changed, encrypted or becoming inaccessible.

The NCSC's current malware guidance also highlights unusual fan activity, network slowdowns and unknown pop-ups as warning signs, while recommending current patches, strong authentication, safe downloads and tested backups as core protections.

Do not try random fixes first

If a business device is behaving suspiciously, contact IT/security support before installing cleanup utilities, deleting files or wiping the computer. Those actions can remove useful evidence or make it harder to understand what the malware accessed.

Contain the risk

The right response depends on the incident, but it may include isolating the device, revoking sessions, resetting affected credentials, reviewing endpoint/security alerts and checking whether the same activity appears elsewhere in the business.

Check what the device could reach

A malware incident is not only a laptop problem. If the user had active Microsoft 365 sessions, saved credentials, administrator rights or access to sensitive applications, review those systems as part of the investigation.

Prevent the next infection

Keep operating systems, browsers and applications patched, use managed endpoint detection, remove unnecessary administrator rights, control software installation and maintain tested backups.

If the incident becomes ransomware or widespread business disruption, see how ransomware attacks typically unfold. NZ businesses can also report malware and other cyber incidents to the National Cyber Security Centre.