A cross-platform payload is malware or attacker-controlled code designed to run on more than one operating system, such as Windows, macOS, or Linux. Attackers may use the same campaign logic but deliver separate builds or variants for each platform so the payload works on the victim’s device.
This matters because it lets an attacker keep one lure or delivery method while adapting the final malware to the target environment. In practice, defenders may see a Windows loader and a macOS backdoor tied to the same operation, which can hide the campaign behind normal platform differences. Cross-platform payloads also increase reach: a single social-engineering flow can compromise mixed-device teams, developer workstations, or contractor laptops. Security teams should assume that platform diversity does not equal safety, and should verify files, scripts, and command-line instructions on every supported operating system.