Carberp can spread through phishing emails, malicious websites, or by exploiting vulnerabilities in software. Once it infects a computer, it can also spread to other systems on the same network.