What malicious actions can an attacker perform once malware is loaded on a system?

Steal, destroy, encrypt (ransomware), spread laterally, or self-erase — effectively whatever the compromised account can do.

Full system control — once malware is loaded, an attacker can:

1. Steal information - extract sensitive data
2. Erase data - destroy files and databases
3. Encrypt hard drives - hold data for ransom (ransomware)
4. Spread to other computers - lateral movement in networks
5. Erase itself - avoid detection and forensic analysis

The specific action depends on the attacker's goals (financial, espionage, disruption, etc.).