Fileless malware is already inside your ram and your antivirus never saw it coming
The attack lands silently, leaves no fingerprints on the disk, and vanishes the moment you reboot. Security teams call it fileless; victims simply call it invisible. While the industry still hunts for Trojans hiding in .exe attachments, a new breed of intruder is already executing commands straight from PowerShell, weaponising the very tools Microsoft ships with every Windows machine.
Memory is the new battleground
Traditional scanners index files. Fileless code never touches storage. It piggybacks on PowerShell, WMI, or macros already blessed by the operating system, injecting payloads into legitimate processes like svchost.exe. The result: a ghost that AV signatures can’t catch because, technically, there is nothing to catch. Forensics teams arrive after the fact and find… logs. Empty quarantine folders. A ransom note that materialised in RAM and then dissolved.
Last month Mandiant tracked a cluster dubbed UNC961 that stayed resident for 11 months inside a European telecom. No binaries, no lateral-movement malware, just living-off-the-land binaries chaining into a credential-harvesting pipeline. By the time EDR finally blinked, the actors had exported 400 GB of customer data through a proxy tunnel disguised as regular HTTPS.
Detection without artifacts
Stopping a fileless campaign means abandoning the comfort of hash blacklists. Behavioural analytics is the only lane left: unusual parent-child process relations, .NET assemblies loaded from memory, or a sudden spike in JIT-compiled code. Microsoft Defender’s block-at-first-seen engine now scores scripts in real time, but only if you pay for the E5 tier. Everyone else gets a pop-up that says “Suspicious activity” after the loot is gone.
Even seasoned blue-teamers admit the alert fatigue is brutal. A single red-team exercise last quarter generated 1,800 PowerShell events per hour; 12 were malicious. Spotting the needle means correlating command-line entropy, API call sequences, and outbound traffic to domains younger than 30 days. Miss once, and the attacker owns the domain controller before your coffee cools.
Offense keeps the edge
Criminals share templates on GitHub now. One repo, PowerLessShell, compresses its stager to 180 characters pasteable into an Outlook ribbon. Another wraps payloads in DotNetToJScript so legacy macros can spawn unmanaged code without dropping a DLL. The barrier to entry is a weekend and a Pluralsight subscription.
Meanwhile, security vendors still ship “next-gen” products whose ML models were trained on yesterday’s disk-based samples. It’s like bringing a metal detector to a plastic-knife fight. The gap won’t close until boards stop treating ransomware as an IT problem and start funding teams that can read a ETW trace faster than an attacker can type Invoke-Expression.
So patch your macros, sure. Disable PowerShell v2, absolutely. But the uncomfortable truth: if the adversary lands inside an admin session, the game is already 90 % lost. Fileless is not a new technique; it is the final reminder that trust, once granted, is the ultimate vulnerability. The only reliable fix is removing the human behind the keyboard—or accepting that some ghosts will always get through.