Botnet attack: what it is, how it works, and how to protect yourself

A botnet attack is when a hacker uses a network of malware-infected devices — a botnet — to carry out large-scale cyberattacks. Attackers build botnets by quietly infecting phones, laptops, routers, and smart devices, then controlling them remotely without their owners knowing.

Botnets power some of the internet’s most damaging attacks, including DDoS (Distributed Denial-of-Service) floods, credential theft, spam, phishing, and malware distribution. Here’s how botnet attacks work, how your device could become one of the “bots,” and how to keep it from happening.

A botnet attack is a coordinated cyberattack launched from a network of malware-infected devices that a single attacker, or bot herder, controls remotely. “Botnet” combines the words “robot” and “network,” referring to infected devices, known as “bots” or “zombies,” that act like remote-controlled robots, following the attacker’s commands without their owners’ knowledge.

Botnets aren’t just one type of attack. They often form the infrastructure that criminals rent and reuse as a base for various scams and attacks. A botnet can:

Because botnets, malware, and viruses often get mentioned together, it helps to see how they actually differ. We also have a dedicated virus vs. malware guide. 

Building and running a botnet generally happens in three stages: infection, connection, and attack.

Attackers need to get botnet software (malware) onto a device before they can add it to a botnet. Common entry points include phishing emails or scam texts with malicious links, Trojan horse malware disguised as a legitimate app, compromised websites that trigger silent downloads, and fake software updates. Weak or default passwords on routers, mobile devices, and other internet-connected IoT (Internet of Things) devices are another common way in, along with unpatched vulnerabilities and exposed remote desktop protocol ports.

Once malware is installed, the device connects to the attacker’s command-and-control (C2) server — the botnet’s control center, where the bot herder sends commands to the entire botnet at once, directing infected machines to carry out malicious tasks. From here, the device runs in the background, following commands without obvious signs, so most people don’t notice right away.

Most botnets rely on a single centralized server, but some modern botnets use a peer-to-peer architecture instead, passing commands directly between infected machines.

With enough bots connected, the attacker can coordinate thousands or even millions of devices at once: overwhelming a website with traffic, attempting logins using breached credential lists, blasting out spam and phishing messages, spreading malware further, or enabling other fraud.

Together, these three stages keep botnet operations running: a hijacked device joins a network of others, all following the bot herder’s commands.

Once a device joins a botnet, attackers can point it at almost any kind of cybercrime. Here are the most common ways botnets get used.

DDoS attacks are the most well-known use of botnets. Attackers direct thousands of bots to flood a target — a website, app, or server — with traffic at once, overwhelming it until it slows down or crashes for legitimate users. Attackers use DDoS floods for extortion, to sabotage a competitor, or as a smokescreen for another attack.

Botnets can automate credential stuffing: testing stolen login credentials — username-and-password combinations exposed in data leaks — against many websites at high speed. Because so many people reuse passwords, a single leaked login can unlock several accounts. Some botnets brute-force logins directly, cycling through passwords to steal sensitive information such as saved payment details.

A botnet isn’t itself a scam — it’s infrastructure hackers use to run scams at scale. Botnets can help attackers send large volumes of phishing or scam messages designed to trick users into clicking malicious links and direct victims to fraudulent websites. Compromised accounts within a botnet’s reach can also be used for impersonation or further scams. The more messages sent, the more convincing a campaign looks through volume alone, which is why catching phishing early matters.

Spam and scam distribution heavily overlap. Botnets pump out unsolicited messages, some just annoying, some carrying phishing links or malware. Beyond spreading itself, a botnet can also deliver other malware, including ransomware and spyware, which is why infections tend to compound over time.

Some botnets hijack a device’s processing power to mine cryptocurrency for the attacker, known as cryptojacking. Victims typically notice this through slower performance, higher electricity use, and overheating, rather than any direct financial loss.

A few real-world botnets show just how far this can go.

The Mirai botnet attack is the one most people have heard of, and for good reason. In October 2016, it was used to launch a massive DDoS attack against Dyn, a company that manages critical internet infrastructure. The attack knocked major sites offline, including Twitter, Spotify, and GitHub, and involved tens of millions of IP addresses at its peak, disrupting roughly 75% of Dyn’s monitored global network over about 18 hours^[1].

What made Mirai notable was its target: everyday IoT devices like security cameras and home routers, turned into an army of zombie computers simply because their owners never changed the default password. Its source code was later published online, and variants of it are still used in attacks today.

Mirai isn’t the only dangerous botnet — multiple others have caused major damage in just the past few years, and DDoS isn’t the only thing they’re built for.

In 2025 and into 2026, a botnet named Aisuru became one of the most disruptive on record, built from more than 500,000 infected IoT and Android devices and responsible for one of the largest DDoS attacks ever measured. A later variant expanded the infected footprint to more than 2 million Android TVs and streaming devices^[2].

Not every botnet stays quiet, either. In late 2023, a botnet called Pumpkin Eclipse didn’t just take over devices — it bricked roughly 600,000 routers at a single internet provider over just a few days, permanently disabling them rather than using them for an attack ^[3]. It’s a warning that a botnet infection doesn’t always end with “your device gets used;” sometimes it ends with “your device stops working.”

Botnet malware is designed to run quietly, but a few symptoms can be a red flag:

These checks matter more than watching for performance alone, since not every infection shows obvious signs.

A full antivirus scan is the most direct way to check for botnet malware, flagging known malware code signatures and suspicious background processes that manual inspection would miss.

Review your router’s connected-device list and data usage for spikes you can’t explain, especially outbound traffic sent when you’re not actively online. Persistent connections to unfamiliar servers are worth investigating.

Go through installed apps and browser extensions for anything you don’t recognize. Botnet malware sometimes hides malicious files inside a program that looks legitimate at a glance.

If you suspect your device is infected, work through this checklist:

No single step eliminates the risk of a botnet attack, but these steps, layered together, cover your devices from multiple angles.

Software updates patch the vulnerabilities that botnet malware often exploits. Turn on automatic updates for your operating system, apps, and router firmware where possible.

Weak or default passwords are how a huge share of routers and other IoT devices end up in botnets. Use a unique, strong password for every connected device, not just your main accounts. One catch worth knowing: on some routers and smart devices, the vulnerable credential is hardcoded into the firmware rather than something you can change yourself. If you can’t reset it, replacing the device may be the only real fix.

Multi-factor authentication (MFA) adds a second checkpoint beyond your password, so a compromised credential alone isn’t enough for an attacker to take over your account.

Phishing emails, scam texts, and fake websites are common entry points for botnet malware. Recognizing and blocking these threats early cuts off some of the first steps that lead to infection.

Surfshark’s Text and Email Scam Protection helps identify scam messages and emails before you click on them. It doesn’t detect or remove an existing botnet infection — its role sits earlier in the attack chain, helping you avoid the content that leads to infection in the first place.

Surfshark Antivirus delivers the next layer, scanning for and detecting malware that reaches your device. Together, the layers work like this: text and email scam protection and Clean Web help you avoid deceptive messages, links, and websites that pose threats, while Antivirus catches malware that gets through.

Stolen credentials can be exploited for account takeover, credential stuffing, or further scams, often long after the first breach. Surfshark Alert monitors for your personal information appearing in known data leaks, so you can change compromised passwords faster.

A VPN encrypts your internet traffic and improves your privacy, which matters most on public Wi-Fi, where traffic is easier to intercept. A VPN doesn’t stop botnet malware or scams on its own — it secures your connection, not your device or inbox, which is why it works best alongside the layers above. Get started with Surfshark VPN or explore Surfshark’s full learning hub for more online safety guides.

Botnets turn everyday, compromised devices into remotely controlled networks that attackers use for DDoS attacks, credential theft, spam, phishing, and other scams. Devices get pulled in through vulnerabilities, weak passwords, malicious downloads, and phishing, often without any obvious warning signs.

Because entry points vary so much, no single tool fully closes the gap. Preventing infection takes multiple layers: recognizing scams, protecting devices from malware, monitoring exposed credentials, and securing your connection.