Internet & Web
Downloads can carry hidden malware when they come from the wrong place. Learn how to choose official sources and check files before you ever open them.
A safe download comes down to two checks you can do in under a minute: confirm the source is the software's real publisher, and confirm the file you received is the file they published. Everything else — antivirus, browser warnings, common sense about pirated games — is a backstop for when one of those two checks slips. This guide walks through exactly how to run both, with the specific settings, tools, and warning signs that separate a clean installer from a booby-trapped one.
The single decision that matters most happens before the download starts. On Windows, prefer the publisher's own site or the Microsoft Store; on macOS, the developer's site or the Mac App Store; on phones, the Apple App Store or Google Play. Store apps run inside a sandbox and go through automated review, which is why a malicious app on Google Play is a news story and a malicious app on a random APK site is a Tuesday.
For desktop software, package managers are an underused safe path. Windows ships with winget (run winget install Mozilla.Firefox in PowerShell), macOS has Homebrew (brew install --cask firefox), and Linux has apt, dnf, or pacman. These pull from curated repositories and verify the download's integrity for you, so you skip the fake-button minefield entirely.
Do not click the first result when you search "download VLC" or "download Zoom." Attackers buy ads and SEO placement that mimic the real brand, then serve an installer bundled with adware or a remote-access trojan. Type the known domain directly (videolan.org, zoom.us) or use a bookmark. When a colleague or a support agent sends a download link, open a new tab and navigate to the official site yourself rather than following theirs — a legitimate company will never lose anything by you doing that.
Reputable Windows and macOS software is code-signed: the publisher cryptographically stamps the installer so your OS can confirm it hasn't been altered since it left them. Checking that stamp takes seconds.
On Windows, right-click the downloaded .exe or .msi, choose Properties, and open the Digital Signatures tab. A trusted download shows the publisher's name (e.g., "Google LLC" or "Valve Corp") with a valid signature. If that tab is missing entirely, or the signature reads "unknown publisher" for a big-name app, stop. On macOS, the OS enforces this for you through Gatekeeper — a properly signed and notarized app opens normally, while an unsigned one triggers "cannot be opened because Apple cannot check it for malicious software." Do not reflexively right-click and Open to bypass that; treat it as the warning it is unless you are certain of the source.
Big projects — Linux ISOs, VeraCrypt, KeePass, Node.js — publish a SHA-256 checksum next to the download. This is a fingerprint of the exact file. To confirm yours matches, run in PowerShell:
Get-FileHash .\filename.iso -Algorithm SHA256
On macOS or Linux, use shasum -a 256 filename.iso. Compare the output to the value on the official page; a single mismatched character means the file was corrupted in transit or tampered with. This is the one step that catches a compromised download mirror even when the site itself looks perfect.
Windows hides extensions by default, which is exactly what makes invoice.pdf.exe look like a harmless PDF. Fix it once: open File Explorer, go to the View menu, and enable File name extensions (on Windows 10, it's View > Show > File name extensions). Now you can see the true type of everything you download.
With extensions visible, watch for the mismatch that gives malware away. A document, photo, or video should never arrive as an executable. Treat these extensions as high-risk whenever you didn't specifically expect a program: .exe, .msi, .scr, .bat, .cmd, .js, .vbs, and .lnk shortcuts. A resume or invoice that unzips into a .scr or .js file is malware roughly every time.
Attackers increasingly ship malware inside .zip, .rar, .iso, or .img files. There's a technical reason: Windows attaches a Mark of the Web (MOTW) tag to files you download, which is what lets SmartScreen and Defender scrutinize them — but files extracted from a mounted ISO or some archive tools can lose that tag, slipping past the usual warning. If an email attachment is a disk image you'd have no normal reason to receive, don't mount it.
Modern systems already include strong protection; the mistake is disabling it. On Windows, Microsoft Defender and SmartScreen are on by default — confirm under Settings > Privacy & security > Windows Security > Virus & threat protection, and under App & browser control > Reputation-based protection. SmartScreen flags files that few other people have downloaded, which is why a brand-new malware sample gets a warning even before any antivirus has a signature for it.
Keep your browser and OS updated, because download protections ship in those updates. In Chrome, switch on Enhanced Safe Browsing (Settings > Privacy and security > Security) for real-time checks against Google's list of dangerous files. When any of these tools throws a warning, believe it — the false-positive rate is far lower than the cost of ignoring a true positive.
For a file that arrived unexpectedly, upload it to VirusTotal (virustotal.com) before opening. It checks your file or URL against roughly 70 antivirus engines at once, so a detection you'd miss with one scanner shows up here. It accepts files up to about 650 MB. One caveat: whatever you upload becomes visible to security researchers, so don't send private documents — for those, right-click and run a local Defender scan instead.
Cracked software, "free premium" apps, and pirated movies are among the most reliable ways to get infected, and the reason is structural, not moral. To run a cracked program you often must disable your antivirus and run an unsigned executable with admin rights — you are manually switching off every defense described above. The people distributing cracks aren't charities; bundling a keylogger, a ransomware dropper, or a cryptominer is frequently how the operation is funded. No store reviewed it and no signature vouches for it. If cost is the issue, the safer routes are the official free tier, a legitimate trial, or a reputable open-source alternative.
No. The padlock (HTTPS) only means your connection to the site is encrypted, not that the site is honest — phishing pages get free certificates too. It confirms nobody is tampering with the file in transit, but a malicious file served over HTTPS is still malicious. Verify the domain and the publisher's signature, not just the lock.
The genuine link is usually the plainest one, often a small text link, while the large flashing buttons are ads that install something else. Hover over each link and read the destination URL at the bottom of the browser. If a page demands you first install a "download manager" or helper app just to get your file, close the tab.
Disconnect from Wi-Fi or unplug the network cable to stop it communicating out, then run a full scan with Microsoft Defender (Virus & threat protection > Scan options > Full scan). Change passwords for important accounts from a different, trusted device, and enable two-factor authentication. If it demanded a ransom or you handle sensitive data, treat the machine as compromised and consider a clean reinstall.
They're much safer but not absolutely guaranteed. Store apps are sandboxed and reviewed, which blocks the vast majority of threats. Rare malicious apps still slip through review occasionally, so it's worth glancing at the developer name, the review count, and the requested permissions before installing something unfamiliar.
Priya translates the fast-moving world of AI and the internet into things you can actually use and understand. She's curious but skeptical, quick to separate genuine progress from hype, and keen to help readers use new tools wisely rather than fearfully.
Keep reading
A crowded inbox drains attention all day. Here is a calm, repeatable system to clear the backlog and keep your email tidy without living inside it.
Priya Nadar
Forgotten subscriptions quietly drain money every month. Here is a calm, practical way to find every one of them, cancel cleanly, and keep the list short.
Priya Nadar