A finance manager calls the helpdesk because their browser keeps opening casino pop-ups and the home page changed itself. Annoying, but harmless-looking. On the same floor, another user has no symptoms at all; their machine feels fine, and yet every password they type is being read by someone far away. And on a server in the data center, a few lines of code have been sitting quietly for two weeks, waiting for one event before they wipe a database. Three very different threats, and only one of them announces itself.
These are the quieter members of the malware family, and they are easy to miss because their symptoms are subtle or absent. On the CompTIA Security+ SY0-801 exam this sits under objective 2.5, which asks you to analyze indicators of malicious activity given a scenario. This lesson covers spyware, adware, keyloggers, rootkits, and logic bombs: what each one does, the traces it leaves, and, for rootkits especially, why finding one changes how you recover. Viruses, worms, trojans and ransomware were the previous lesson; fileless techniques are the next one.
Spyware steals information quietly while adware mostly just annoys
Spyware is malware that gathers information about a user or organization and sends it to someone else without consent. It can capture browsing history, form data, credentials, documents and screenshots. The defining trait is covert data collection: spyware wants to stay installed and unnoticed so the stream of information keeps flowing. On the job the indicators are indirect, since there is little a user sees: unexpected outbound connections to unfamiliar hosts, a browser that behaves oddly, or data turning up somewhere it should not be.
Adware displays unwanted advertising. Classic adware injects ads into pages, opens pop-ups, redirects searches, and changes the browser home page or default search engine. It is usually more nuisance than catastrophe, but it is not harmless: adware often arrives bundled with a free download, tracks browsing to target ads, and can be the visible sign of a wider unwanted-software infection. A hijacked browser, new toolbars no one installed, and redirected searches are its signature.
The pair are easy to confuse in an answer list, so separate them by intent. Spyware is about stealing information secretly; its goal is to not be noticed. Adware is about showing you things and making money from your attention; it is loud by design. If the scenario stresses hidden data exfiltration, choose spyware. If it stresses pop-ups, redirects and a changed home page, choose adware. A potentially unwanted program, or PUP, is the broader label for this bundled, borderline software, and the controls are the same: careful software sourcing, application allow-listing, endpoint protection, and browser hardening.