A shellcode loader is malware that prepares and starts shellcode, which is small machine-code payload that runs directly in memory. Its job is often to act as an execution bridge: it sets up the environment, decrypts or unpacks the next stage, allocates memory, adjusts permissions, and transfers control to the payload.
This matters because loaders help attackers separate delivery from execution. The initial file may look harmless, signed, or incomplete, while the real malicious logic appears only after the loader runs. In modern attacks, shellcode loaders often use indirect APIs, callback paths, process injection, or legitimate-looking host binaries to reduce visibility in EDR tools and bypass simple hash-based detection. Defenders look for unusual process chains, memory allocation followed by executable pages, suspicious module loads, and network activity that does not fit the parent application’s normal behavior. In practice, a shellcode loader is often the first clear sign that a campaign is moving from access to active payload deployment.