Rootkits replace parts of the operating system with an attacker’s code to hide malicious files and processes from the system's own security tools.