A pay-per-install loader is a delivery component used in criminal malware chains to place additional payloads on a compromised system. Instead of being the final malware itself, the loader acts as the installer or dropper: it contacts an operator-controlled server, retrieves the next-stage file, and launches it with the right permissions and persistence steps.
This matters because the loader turns infection into a business model. Criminals can sell installs to other operators, reuse the same foothold for different payloads, and swap modules for theft, mining, proxying, or remote access. Defenders often see the loader first through behaviors such as Defender tampering, process injection, unusual child processes, or unexpected downloads from a trusted-looking binary. Blocking the loader stage with application control, tamper protection, and rapid isolation can stop later payloads from ever running.