Common flavours: viruses, trojans, ransomware, spyware, cryptominers. WordPress sites are the #1 vector for law firm compromises — usually via outdated plugins. Defence: keep everything patched, use a WAF, scan periodically, rotate credentials after any suspected exposure.