What is a Payload in the context of malware?

The payload is the part of malware that actually does the damage — the rest just gets it there and runs it.

The payload is the portion of malware that performs the malicious action (e.g., stealing data, encrypting files).

In general computing, payload means the actual intended message in transmitted data (as opposed to headers/metadata). In the context of malware (virus or worm), it specifically means the code that carries out the attack.

Example actions:

• Steal information
• Erase data
• Encrypt hard drives (ransomware)
• Spread to other computers
• Erase itself to avoid detection

Go deeper:

• Malware (Wikipedia) — payload mechanisms (credential theft, ransomware encryption, backdoors).