The game begins with Spider-Man searching for Mary Jane in a symbiote-infested New York. During a flashback to four days earlier, Spider-Man retells his account of how his encounter with Venom ended with a piece of the symbiote binding to himself. After the fight with Venom, Spider-Man meets Luke Cage during a gang drive by shooting. Cage explains that the Rolling Sevens and Park Avenue gangs are at war, and that their task is to bring the two to a truce. After pursuing the two gang leaders across the city, Spider-Man manages to get them to agree to a peaceful meeting in Central Park.
Outside the rendezvous point, Spider-Man discovers several high-tech assassins on top of the nearby buildings. He traces the assassins back to the Kingpin. After a few encounters with Black Cat, Moon Knight, Vulture, and Kingpin’s gang, Spider-Man and the Kingpin's henchmen are attacked by symbiote-controlled citizens of New York City. The police soon arrive and Spider-Man is witnessed throwing a symbiote controlled person off of a building and is then considered to be a murderer.
As the game progresses New York becomes more overrun with symbiote hives.Wolverine, thinking Spider-Man to be possessed by a symbiote, tracks down and confronts the web slinger. After a brief battle, the two settle their differences and begin tracking down infected citizens. Eventually Spider-Man finds Venom throwing people into symbiote pods, leaving them infected. After the pods are destroyed, S.H.I.E.L.D. quarantines New York and sets up symbiote controlled citizen quarantine camps. Electro attacks one of the camps looking for his sister, who is symbiote controlled, and becomes infected himself attempting to help her.
Spider-Man decides the only way to save New York is to break the Tinkerer out of Ryker's Island. Upon reaching the prison, Spider-Man frees the Rhino, using his strength to help free the Tinkerer. The Tinkerer then designs a device to be installed on the Trask Building that removes the symbiotes from their hosts without causing harm to the host. After defeating symbiote controlled versions of Electro, Wolverine, Black Cat, and the Vulture, depending on the player's actions earlier in the game, Spider-Man either activates the device and destroys all the symbiotes including his own or destroys the device. Either way, Spidey responds an attack on the S.H.I.E.L.D. Helicarrier by Venom and the remaining symbiotes.
Enlisting Moon Knight or Vulture to carry him to the Helicarrier, Spider-Man sets bombs to destroy the ship, but is attacked by a giant five headed version of Venom. Spider-Man is able to destroy four of the heads, and calls on Brock to try and assist with destroying the symbiotes. Realizing the destruction that has been caused by the Venom symbiote, Brock sacrifices himself, the Alternate ending involves Spider-Man killing Venom. The symbiote monster weakens, and the Helicarrier explodes.
Based on the player's actions throughout the game, Web of Shadows concludes with one of four possible endings. If the player has made a majority of red-suited choices, Spider-Man narrates about his victory on the top of a building before swinging away with Mary Jane. If the player has made slightly more red-suited choices than black, he calls Mary Jane to try and apologize about his actions during the invasion. If the player has made slightly more black-suited choices than red, Spider-Man leads the symbiote conquest of Manhattan and is hunted by Wolverine, who has bonded with another symbiote. If the player has made a majority of black-suited choices, the former ending is amended to show a symbiote-controlled Black Cat by his side during the invasion.
