A builder is a tool that assembles customized malware from a base code set, often with options for features, targets, persistence, or delivery settings. Instead of shipping one fixed payload, the operator can generate many variants from the same framework, which makes the malware easier to reuse, disguise, and distribute at scale.
In cybercrime, builders are common in infostealers, ransomware kits, and other Malware-as-a-Service offerings. They matter because they lower the skill needed to deploy harmful code while speeding up iteration: one build may steal browser passwords, another may focus on cookies, tokens, or system data. For defenders, “builder” language is a sign of commoditized attack tooling, so detection should look for both the malware family and its changing variants. Blocking execution, monitoring suspicious packaging or configuration activity, and treating stolen session data as compromised can all help reduce impact.