Is there malware that can run from a simple download from the internet autonomously without user interaction/initiation?
I know there are worms that can do that, but I assumed they needed to be opened or maybe interacted with subtly maybe through different apps.
If so what is the malware that can do this and how do they work?
In theory this is possible. Browser zero-day vulnerabilities can sometimes leverage their access to the system to download and execute the downloaded binary (see example here). This is however extremely rare and the chances of seeing this in the wild are low.
Regarding what you saw on TikTok - there are all kinds of methods to combine executable binaries with different file extensions (example). This is usually not a vulnerability but rather a feature used for the wrong purposes.
You should never open anything that you did not download and usually deleting it straight away will not harm your computer unless clicked on.
Is there non-malware that can just run without user interaction? In that case, yes, if the malware can trick your device into believing that it is non-malware.
For example, Apple can automatically update your iPhone system software if you allow it. A hacker can send you something that looks superficially like a software update, close enough for your phone to examine it. If you managed to create a package that convinced your iPhone that it is a genuine software update then the code would automatically be run. (There’s probably nothing on iOS or android devices that is better protected, so this is not going to happen).
On iOS applications can register for url schemes. So links that don’t start with http:// or https:// but with gnasher:// for example could be sent to an app on your phone that I have written. If your browser decided to do that automatically (which it shouldn’t) then the url would be sent to my app without further user interaction. I’d consider that a major vulnerability in the browser. But then if there are major vulnerabilities then things go wrong.
