A delivery chain is the sequence of steps an attacker uses to move a malicious payload from the initial lure to execution on a victim device. It can include email delivery, a link or attachment, a follow-up message, a download stage, a script, and finally the payload that runs on the endpoint.
This matters because defenders often focus on the first lure, but the real compromise may happen later in the chain. Attackers can split delivery across multiple stages to evade filters, delay suspicion, or wait for user interaction such as a reply or click. In practice, defenders look for changes in the chain: unexpected attachments in a familiar thread, new download instructions, file-type switches, or process behavior on the endpoint. Mail security, web filtering, and EDR work best when they are correlated across the whole chain, not treated as separate events.