Malware
Trojan
Also called trojan horse.
Trojan is malware that looks like something useful, such as a cracked app, a theme, or an invoice, and does something else once you run it. It does not spread by itself; you invite it in.
How it is measured
Confirm by comparing what a program claims with what it does. A 'free' premium WordPress theme that contains base64 in functions.php, an installer that opens a connection to an unrelated host, or a document that launches a script all fit. Check hashes against the vendor's official download.
Look at the delivery path: a download site, a torrent, a forum post, an email attachment. Record where the user got it, since that route often hosts other copies.
Worked example
A blogger downloads a nulled copy of a $59 page-builder plugin from a forum. After activation, an admin user named 'wp_support' appears and the site starts sending 2,000 outbound POSTs a day. The plugin's main file passes a long string to base64_decode.
The plugin worked as advertised, which is why nobody noticed for six weeks. Removing it deletes the visible code, but the extra admin and a scheduled event in wp_options still have to be cleaned.
How it differs
Malware is the whole family. A trojan is defined by disguise and by needing the victim's choice to run it; a worm spreads by itself and a virus rides on host files. A trojan can drop a backdoor, a ransomware payload, or a stealer once it has run.
Common errors
Installing nulled plugins and themes to save a license fee. Judging safety from the file working normally. Cleaning the plugin and keeping the users and jobs it created. Trusting a download because it ranks high in search. Disabling antivirus because an installer asks.
In practice
Install software only from the official source and verify a checksum where one is provided. Audit your site for plugins and themes that did not come from their vendor, replace them with licensed copies, and check for admin users and scheduled tasks you did not create.