A rootkit is malware built to hide deep in the operating system. Its job is not only to run, but to make normal security checks unreliable by concealing itself and sometimes other malware.
Does this affect you?
Use this mainly for Windows PCs and Macs. Rootkits can exist on mobile devices too, but they are more commonly discussed around full desktop operating systems.
What makes a rootkit different from ordinary malware
Most malware wants to execute. A rootkit wants to execute invisibly.
- It tries to gain administrator, system, or root-level access so it can control sensitive parts of the device.
- It hides itself by interfering with the same operating-system functions that would normally list files, processes, or services.
- It can hide other malware, such as spyware or keyloggers, making the whole compromise harder to see.
- It may resist normal cleanup because the infected system itself cannot be fully trusted to report what is happening.
- It arrives through familiar paths: phishing, malicious downloads, unpatched vulnerabilities, bundled malware, or pirated software.
What to look for
Rootkits are designed to avoid obvious symptoms, but these signs are worth investigating.
- Security software turns off, fails to update, or crashes.
- The system becomes unstable or behaves differently after a suspicious download.
- Network activity appears when no obvious app is using the internet.
- Scans report recurring threats that seem to return after removal.
- Startup, driver, or firmware behavior changes unexpectedly.
More control
Modern systems are harder to rootkit
Secure Boot, kernel integrity checks, driver signing, and operating-system protections make deep rootkit infections harder than they once were, though not impossible.
Use dedicated detection when concern is real
Reputable security vendors offer rootkit-detection tools that check at a lower level than normal scans. Use known vendors, not popup or ad-based tools.
Confirmed rootkits may need a clean rebuild
For a deep confirmed infection, reinstalling the operating system, resetting firmware, or updating firmware may be the only way to be confident the device is clean.
Sources
- CISA – Protecting Against Malicious Code (2025)
- Microsoft Support – Protect my PC from viruses (2025)
- Malwarebytes – What Is a Rootkit? (2025)