This is such a stupid way to think about it ("but what even IS malware") and you're obviously completely ignorant as to how threats like phishing are handled.