Attacks and malware
What is Payload?
The part of an attack that does the attacker's actual work once delivered, such as installing malware, as opposed to the mechanism that got it there.
A payload is the part of an attack that carries out its purpose after delivery: the malware that gets installed, the script that runs, or the commands executed after an exploit succeeds. The email, document or exploit is the delivery vehicle. The payload is what it carries.
Separating the two helps analysis. The same delivery method, such as a malicious attachment, can carry very different payloads, and one payload can arrive through many delivery methods.