A malware dropper is a small malicious program whose job is to install, unpack, or launch a larger payload. The dropper may look simple on its own, but it is often the first stage of a more serious compromise, delivering ransomware, spyware, a backdoor, or other tooling after it reaches a target system.
Drops matter in cyber security because they help attackers hide their intent and bypass basic detection. A dropper may be embedded in a document, script, installer, or trusted code update, then execute later to fetch or activate the real malware. Defenders look for suspicious process spawning, encoded payloads, unusual downloads, and changes in software supply-chain workflows. Blocking the first stage can stop the entire attack chain before the final payload runs.