A supply-chain-style attack abuses a trusted distribution point so malicious code reaches victims through a path they already trust. Instead of breaking into each endpoint directly, an attacker compromises a server, update channel, installer repository, package mirror, or other software handoff point and then uses that position to deliver tampered files or commands downstream.
This matters because trust scales the impact. One compromised source can expose many users, devices, or organizations at once, especially when the same platform handles logins, downloads, and updates. In practice, defenders look for strong code-signing, integrity checks, least-privilege administration, and monitoring of server-side file changes and outbound downloads. Endpoint protection also helps catch suspicious installers or post-install behavior such as unauthorized persistence or remote control. The key idea is simple: when the trusted path is poisoned, normal user behavior becomes the delivery mechanism.