Runtime code download is a technique where an application retrieves extra code after it has already started running. Instead of shipping every function inside the original app package, the developer or operator defers part of the logic until later, often by pulling scripts, modules, or a secondary payload from a remote server.
This matters in cyber security because it hides behavior from static review. A file may look harmless during upload, app-store scanning, or signature-based analysis, yet become dangerous only after installation. Attackers use runtime downloads to stage malware, deliver banking Trojans, or change behavior to evade detection. Defenders look for the signs: unusual outbound connections, unexpected file or module fetches, and apps whose runtime activity does not match their advertised purpose. Monitoring post-install behavior is therefore as important as inspecting the initial package.