Is there is a way to create a better anti-malware tool by utilizing malware to fight against malware itself? I've looked up how anti-malware works and searched a lot in famous sites like Avast Blogs (Academy) and articles on McAfee, but nothing addressed this question.

Is it (ever) possible to make malware fight for us? Even in a theoretical way that requires technology that we don't yet have?

  • There have been recent cases of vigilante botnets doing this by patching out whatever vulnerability they used to get on (notably illegally without authorization). Commented Mar 7, 2020 at 15:01

1 Answer 1


Disclaimer: I do not advocate any of the approaches described in my answer, as I do not consider them ethical and they are not even legal in many countries. This is just an academic answer to an interesting question!

To answer this question, we must distinguish between malware itself and the mechanisms malware is using. To qualify as malware, a piece of software needs to be intentionally designed to cause damage. This is not what we want. So why isn't the answer to your question a clear and resounding "NO"?

One common malware property is the ability to spread from system to system, infecting more and more targets. A worm for example exploits known vulnerabilities to spread from one computer to the next, gaining a foothold on each hop. This can already be problematic by itself, because it uses resources and might (even if just accidentally) cause problems on the affected systems. What the malware does in addition to that (e.g. encrypt files, mine crypto-currency, display dancing monkeys on the screen) is up to the payload of the malware.

This is the point where your idea comes in. Instead of doing intentional harm, the payload could be designed to fight other malware, either by cleaning an affected system directly or by patching the vulnerability other malware uses to spread.

Example: Lets assume there is a worm-able vulnerability in the Apache web server that's exploited in the wild. An anti-malware worm could use exactly this vulnerability to spread to affected systems, gain a foothold there and patch the vulnerability afterwards. If the anti-malware worm arrives there first, no other malicious worm can use this now patched vulnerability to attack the system. And if the system is already infected, the anti-malware worm could even try to remove it like a normal anti-malware product would. After securing the system, the anti-malware worm could look for other vulnerable systems in range, spread there as well and finally remove itself from the current system, which it has protected.

There we have it. We leveraged malware-like behavior to fight of real malware. So why do I discouraging and warn against such actions?

While it may sound good in theory and it may be an interesting though experiment, you still invade other systems without consent and might accidentally cause severe harm to those systems. That's why this is a theoretical concept and not done in practice by law-abiding security actors.

  • I looked up some friendly malwares like Linux.Wifatch. And your answer suggests that a malware behavior can be used in an ethical way, however am not sure if there is a way to utilize a malware that is already harmful so that to make it useful, all I can find is some sort of protection, however your answer makes since and is in no way wrong, I would appreciate it If you could provide us with any additional information. Many thanks.
    – Mr. N
    Commented Mar 8, 2020 at 13:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .