A payload is malware that the threat actor intends to deliver to the victim. A payload is the component of the attack which causes harm to the victim. Much like the Greek soldiers hiding inside the wooden horse in the tale of the Trojan Horse, a malicious payload can sit harmlessly for some time until triggered.
Attack vectors such as viruses, wurms, and malware can all contain one or more malicious payloads. Malicious payloads can also be found in email attachments, in fact Symantec has reported that one in every 359 emails in existence contains a malicious payload, and this ratio is trending upward.