A multi-stage loader is malware that splits infection into separate steps. One component acts as a first-stage dropper or launcher, then passes control to later modules that fetch, decrypt, or execute the final payload. Each stage may look limited on its own, which helps the malware blend into normal software activity and makes static analysis harder.
This design matters because defenders may only see a harmless-looking installer, script, or trusted utility such as a build tool, while the real malicious behavior happens later. Attackers use multi-stage loaders to hide intent, reduce exposed code, and swap payloads without changing the initial lure. In defense, analysts should trace child processes, command lines, dropped files, and network activity across the full execution chain, not just inspect the first file. Detecting unusual tool use, script execution, or library loading can expose the handoff between stages.