A malware delivery chain is the full path attackers use to place malicious code on a target. It can include a lure domain, phishing page, download host, redirector, cloud bucket, exploit page, staging server, and final payload. Each step helps move the victim from initial contact to infection.
This term matters because defenders rarely see only the final malware file. They often see pieces of the chain: domains, IP ranges, hosting providers, file hashes, and command-and-control endpoints. By mapping these parts together, analysts can block earlier stages, spot reused infrastructure, and attribute related campaigns even when attackers rotate domains or payloads. In practice, hunting the delivery chain is often more effective than reacting to a single malicious URL.