A script payload is executable code delivered during an attack, usually as JavaScript, PowerShell, batch, or another script that can run commands on a victim system. It may be hidden inside a web page, an archive, a cached browser file, or a disguised document, and it is often used to start the next stage of compromise rather than do all the damage at once.
Script payloads matter because they bridge delivery and execution. Attackers use them to download additional malware, steal data, alter settings, or open a remote command channel. Defenders look for signs of script execution, unusual browser-to-shell activity, and scripts launched from places that should contain inert content, such as image files or cached web assets. Limiting script interpreters, using application control, and monitoring suspicious command lines can reduce the risk.