A script-based framework is a malware architecture built from scripts or other flexible code modules that can be reused, swapped, or updated across different operations. Instead of a single monolithic binary, the operator may use small components for tasks such as downloading payloads, running commands, collecting data, or handling command-and-control.
This design matters because it makes malware easier to adapt and harder to fingerprint. Attackers can change a script, add a new module, or reconfigure behavior without rebuilding the whole toolset. In real intrusions, script-based frameworks often appear in web-based control systems, loaders, and post-exploitation tooling where HTTP or HTTPS traffic is used to exchange commands. For defenders, these frameworks are often detected by behavior: unusual scripting activity, repeated outbound beacons, non-browser processes making web requests, or modular execution patterns that do not match normal software.