In an aspect, an apparatus obtains a first payload that is dynamically loaded by an application program of the apparatus. For example, the first payload may be dynamically loaded by an application program (e.g., during run time) for execution on the apparatus. The apparatus determines whether the first payload includes malicious content. The apparatus prevents execution of the first payload when the first payload includes the malicious content, and executes the first payload when the first payload does not include the malicious content.