Loader-as-a-Service (LaaS) is a criminal business model that rents out malware delivery infrastructure. Instead of building every tool from scratch, an operator can buy access to a ready-made loader, hosting, redirect chain, or execution service that helps deliver second-stage malware onto a victim system.
LaaS matters because it lowers the skill and cost needed to run attacks while making campaigns easier to scale and replace. In practice, it is often used to distribute stealers, ransomware, RATs, or other payloads after an initial lure, phishing message, or social-engineering step. Defenders may see repetitive delivery patterns, shared infrastructure, or common loader behavior across unrelated incidents. Hunting for LaaS activity usually means monitoring initial execution, unusual script or command-line activity, and follow-on network connections rather than focusing only on the final payload.