A multi-stage payload is an attack chain delivered in separate steps instead of as one complete malicious file or command. The first stage is usually small and quiet: it may establish a foothold, download the next component, or set up a communication channel. Later stages then add capabilities such as credential theft, persistence, lateral movement, or an interactive shell. Splitting the attack this way helps attackers reduce detection, bypass simple scanners, and change behavior if a stage is blocked.
In real intrusions, multi-stage payloads are often used after social engineering or initial access. A user may approve remote support, open a lure, or run a small loader that fetches the real tooling only after it lands. Defenders should watch for unusual process chains, script interpreters spawning network connections, and outbound traffic that appears after a seemingly harmless first action. Detection improves when security tools correlate each stage instead of treating the first file or message as the whole threat.