Staged loading is a multi-step malware delivery method where one component first runs as a loader, then unpacks, decrypts, or retrieves the next stage before the final payload executes. Instead of dropping a single obvious executable, the attacker splits the operation into layers so each piece looks less suspicious and can evade quick inspection.
This matters in cyber security because it increases stealth and flexibility. A small initial loader can hide inside a legitimate installer, document, or utility, then fetch a second-stage payload only when conditions are right. Defenders may see unusual child processes, script activity, memory-only execution, nonstandard installation paths, or scheduled tasks created during the chain. Staged loading also complicates static scanning, since the most dangerous code may not be present until runtime. Monitoring process trees, command lines, and network connections helps reveal the handoff between stages and expose the full attack path.