On-host compilation means building malware or attacker tooling directly on the victim machine instead of copying in a finished binary. An intruder may use a compiler, scripts, or a build toolchain already present on the system to produce a payload that matches the target environment.
This matters because it can reduce reliance on obvious file drops and may help attackers tailor code to the host before execution. But it also creates noisy evidence: compiler processes, temporary build files, dependency downloads, unusual child processes, and sudden CPU or disk activity. Defenders look for those signs, especially when they appear alongside unauthorized remote access, new persistence, or changes to security tools. In incident response, on-host compilation often suggests hands-on operator activity rather than fully automated malware deployment.