Some software is being developed in such a way that they are always Tethered to a server on the internet in order to function. If the server stops working, the program becomes obsolete. Unless the server's software is published in such a way that anybody can host it, this kind of Tethering is malicious.

A lot of software today have some kind of Surveillance and Tracking. Sometimes it's called Targeted Advertising or Telemetry, but regardless of the name or reason of the Surveillance, all of it is malicious.

Sometimes software is just simply Insecure. Which is a lot worse in proprietary software where users can't check the software for Insecurities.

Though unfortunately Subscriptions in software today are the norm, they are a malicious functionality. Any software that you already have installed should work whenever you want it to work. Having a timer implemented in it, so it will refuse to work, unless you pay every once in a while, is malicious.

A lot of electrical devices today have a switch of some kind to deactivate the device after a certain period of time. Sometimes the device just gets annoyingly slow. In any case, it is implemented in software on that device. And the reason for that is Planned Obsolescence. Forcing the user to throw away this device and buy a new one.

Some software employ Dark Patterns and Manipulation to gain something from users.

A Jail is any operating system that has to be Jail-broken to install applications not approved by the developer.

Sometimes the developers just include into their software something that is there not the user's sake. Which ends up Interfering with user's needs. And it's just plain annoying.

A Vendor Lock-In is when certain software is developed to be incompatible by design with other software that have similar functionality. It is used to establish a monopoly. And any such function is malicious.

Sometimes a program might have a deceiving function that is indented for Fraud.

Digital Restrictions Management or DRM is any software functionality that is designed to prevent you from using the files on your computer the way you want to use those files. This is obviously a malicious feature. And is defective by design.

Sometimes developers of a program will lie to the user knowing very well that they are lying. This kind of Deception is often implemented as a malicious functionality.

Sometimes a program might give you impossible choices were it is impossible to say no to something terrible. This kind of Coercion is a malicious functionality.

Sometimes a programmer might implement a feature designed to undermine the Freedom Of Speech of various people. This Censorship is a malicious feature.

Back Door is a form of malicious feature in which the program is configured to respond to commands sent to it from the developer. A Universal Back Door is an ability of the developer to remotely change the program to do anything the developer desires it to do. Sometimes Universal Back Doors are called "Auto-Update".

Inducing Addiction into people, so they would continue using the same program is a form of a Malicious feature.