Malicious code (malware): spyware.

The idea

Spyware is a form of malware that secretly gathers information about a user's activity and sends it to a third party. It typically installs without clear consent, often bundled with other downloads or hidden in attachments, then runs quietly in the background. It can log keystrokes, record browsing habits, capture screenshots or read stored data such as login details, then transmit that data to the attacker. Because it aims to stay unnoticed, it may not damage files or display obvious symptoms, which makes it harder to spot than some other malware. Learners should be able to pick spyware out from a list of malware types by matching the defining behaviour: covert collection and transmission of user information. Contrast it with viruses that replicate and damage, worms that self-spread across networks, and trojans that disguise themselves as legitimate software.

What earns the marks

• Identifies spyware as malware that secretly collects information about the user or their activity.
• States that the collected data is sent or reported to a third party such as an attacker.
• Recognises that spyware typically operates covertly, without the user's knowledge or consent.
• Distinguishes spyware from other malware by its purpose of information gathering rather than file damage or self-replication.
• Gives a plausible example of data targeted, such as keystrokes, browsing habits or login credentials.

Common mistakes and how to put them right

• Confusing spyware with a virus.

  Put it right: A virus primarily replicates and damages files, whereas spyware primarily gathers and transmits information.

• Assuming spyware always destroys data or crashes the computer.

  Put it right: Spyware usually aims to remain hidden and may cause no visible damage.

• Thinking spyware only affects the device's performance.

  Put it right: Its defining feature is covert collection and sending of user information to a third party.

Exam tips

• Look for the key phrase about secretly gathering information and sending it elsewhere; that points to spyware.
• Eliminate options that describe self-replication (worm) or disguise as useful software (trojan) before choosing.
• If two options seem similar, choose the one focused on monitoring the user rather than damaging files.