CyberGlossary

Malware

Payload

Also known as: Malware payload, Attack payload

Definition

The part of an exploit, malware, or attack that actually performs the malicious action, such as encrypting files, opening a backdoor, or stealing data.

In offensive security, a payload is the code or data that runs after a successful exploit or after a malicious file is opened, and that delivers the attacker's true objective. Typical payloads include reverse shells, command-and-control beacons, encryptors, info-stealers, keyloggers, droppers, persistence installers, or destructive wipers. Modern intrusion chains separate the delivery method (phishing, exploit, drive-by) from the payload, often using droppers and loaders to stage the final code in memory only. Defences include endpoint detection and response, application allow-listing, memory protection (DEP, ASLR, CFG), anti-exploit features, egress filtering, and rapid response when initial indicators are observed.

Examples

  • A Cobalt Strike beacon loaded into memory after a phishing document executes.
  • A ransomware encryptor delivered by a Qakbot dropper as the final stage.

Related terms