The first known use of the expression “spyware” occurred on October 17th, 1994 in a post that joked about Microsoft's business model. Spyware later came to allude to snoop equipment such as diminutive cameras. In early 2000, the man who started Zone Labs used the term in a press release for a new product. Since then, the computer-community has used the term in its current definition.

Spyware often comes wrapped-in with shareware or other software, and with music CDs. The user installs a program, for example, a file-trading utility or music program. The installer also installs the spyware. Even though the acceptable software itself may not do harm, the wrapped-in spyware does. Occasionally, spyware authors will pay shareware creators to wrap-in spyware with their software. An example is the Gator spyware distributed by Claria. There are instances when spyware authors will repackage desirable free software with destructive installers that add spyware.

Another way of propagating spyware is by tricking users. A program will manipulate a security feature that is supposed to prevent harmful installations. Internet Explorer is designed to stop websites from starting an unwanted download. Alternately, a user action must normally trigger a download (like clicking on a link). Nevertheless, links can prove misleading. For example, a pop-up may look like a normal Windows dialog box. The box contains wording like "Do you want to improve your Internet experience?" with links that look like real buttons reading No and Yes. It doesn't matter which button the user selects, a malicious download will start, installing the spyware on the user's computer. Newer versions of Internet Explorer offer better security against this tactic.

Many unscrupulous spyware creators infect a computer by going after security weaknesses in the Web browser or in other applications on the targeted computer. When the user arrives at a Web site controlled by the spyware creator, the site includes code that forces the download and installation of spyware or infiltrates the browser. This kind of spyware creator will have broad knowledge of commercial-quality firewall and anti-virus programming. This is commonly known as a “drive-by download”. It leaves the user an unfortunate onlooker to the intrusion. Conventional "browser attacks" target security weaknesses in Microsoft Java Runtime and Internet Explorer.