A binary dropper is a compiled program whose main job is to place, decrypt, or launch additional malicious payloads. It is often only the first stage of an infection chain, acting as a loader rather than the final tool that steals data or maintains access.
Binary droppers matter because they can hide the real objective of an attack. By splitting delivery across multiple files or stages, attackers make static analysis harder and can make the initial sample look like ordinary software. On macOS and other platforms, droppers may be written in native languages such as Swift, Objective-C, C, or C++, which can help them blend in with legitimate applications. Defenders look for suspicious parent-child process chains, unexpected file creation, decoded payloads, unusual network fetches, and persistence actions that follow the dropper. Detecting the dropper early can stop the rest of the malware family before the final payload runs.