Payload delivery is the stage of an intrusion chain where malicious code, scripts, or other attack components are transferred into the target environment so they can run. It comes after initial access or user interaction and before the payload performs actions such as persistence, credential theft, lateral movement, or encryption.
This stage matters because it is often where defenders can still interrupt the attack. Delivery may use phishing attachments, malicious shortcuts, compressed archives, cloud links, developer platforms, or staged downloads that look like normal traffic. In the context of espionage, delivery may be disguised as a harmless document or shortcut to blend into routine user and developer activity. Security teams look for unusual child processes, suspicious file types, abnormal outbound connections, and authentication patterns that do not match normal workflows. Blocking or inspecting delivery paths can stop the intrusion before the payload fully executes.