Malware
Payload
Also known as: Malware payload, Attack payload
Definition
The part of an exploit, malware, or attack that actually performs the malicious action, such as encrypting files, opening a backdoor, or stealing data.
Examples
- A Cobalt Strike beacon loaded into memory after a phishing document executes.
- A ransomware encryptor delivered by a Qakbot dropper as the final stage.
Related terms
Exploit
A piece of code, data, or technique that takes advantage of a vulnerability to cause unintended behaviour such as code execution, privilege escalation, or information disclosure.
Dropper
Malware whose role is to install ("drop") another malicious payload onto a target system, often after evading initial detection.
Loader
Malware that prepares the environment and loads further payloads — often directly into memory — for a subsequent stage of an attack.
Command and Control (C2)
The infrastructure and channels attackers use to maintain communication with compromised systems and send them instructions.
Fileless Malware
Malware that runs primarily in memory and leverages trusted system tools, avoiding the use of traditional executable files on disk.
Ransomware
Malware that encrypts a victim's data or locks systems and demands payment in exchange for restoring access.