An attack form that is encoded in data that appears harmless and executed by a user or a process, often behind a firewall.