A cross-platform loader is a malicious or dual-use component built to run on more than one operating system, such as Windows and macOS, while fetching, decrypting, or starting a second-stage payload. Instead of rewriting the whole delivery chain for each platform, an attacker can reuse the same loader logic and swap only the final payload or packaging.
This matters because it reduces attacker effort and makes campaigns easier to scale across mixed endpoint fleets. A loader that works in a shared runtime, such as .NET or another portable environment, may look unusual on one platform and normal on another, which can delay detection. Defenders may see it as an unexpected child process, a downloader launched from an installer, or runtime activity that does not match the claimed software.
In real attacks, cross-platform loaders often hide behind trusted installers, update prompts, or branding that users expect to see. Security teams should inspect behavior, not just file names, and enforce approved software paths, code-signing checks, and execution controls on every supported operating system.