Fileless Malware: The Invisible Threat That Traditional Antivirus Misses

Traditional malware leaves traces: executable files, DLLs, scripts, registry entries. Traditional antivirus is designed to find those traces. Fileless malware is designed to leave none. Rather than writing malicious code to disk, fileless attacks operate entirely in memory, using legitimate system tools — PowerShell, Windows Management Instrumentation (WMI), the Windows registry — to execute malicious code that evaporates when the system reboots. This approach is increasingly popular among sophisticated attackers because it bypasses signature-based detection almost entirely.

How fileless attacks work: a typical fileless attack chain might look like this. A phishing email contains a malicious document. When opened, the document uses a macro or exploit to execute a PowerShell command. The PowerShell command downloads and executes a malicious script directly in memory — nothing is written to disk. The script establishes persistence by adding a registry entry that runs another PowerShell command at startup. The entire attack chain uses only legitimate Windows tools (PowerShell, the registry) and leaves no malicious files for a scanner to find. This technique is called 'living off the land' — using the operating system's own tools against it.

Why it's increasingly common: fileless techniques were once the exclusive domain of nation-state attackers. They've since been democratized — fileless attack frameworks are available in criminal underground markets, and commodity malware increasingly incorporates fileless components. The 2017 NotPetya attack, the 2020 SolarWinds supply chain compromise, and numerous banking trojans have used fileless techniques. Endpoint Detection and Response (EDR) vendors report that fileless attacks now account for a significant and growing percentage of successful breaches.

Detection approaches: since fileless malware doesn't write files, detection must focus on behavior rather than artifacts. Behavioral monitoring that watches for suspicious PowerShell execution, unusual WMI activity, or processes injecting code into other processes can catch fileless attacks in progress. Memory scanning — examining the contents of running processes rather than files on disk — can identify malicious code even when it's never written to disk. Script block logging in PowerShell (a Windows feature that logs the content of executed scripts) is a valuable detection tool. Products with strong behavioral detection — Malwarebytes, Bitdefender, CrowdStrike — are better equipped to catch fileless attacks than those relying primarily on signatures.

Hardening against fileless attacks: disable macros in Microsoft Office documents from the internet (File > Options > Trust Center > Macro Settings > Disable all macros with notification). Enable PowerShell Constrained Language Mode, which limits the commands available to scripts. Enable Script Block Logging and Module Logging in PowerShell Group Policy. Use Application Control policies (Windows Defender Application Control or AppLocker) to restrict which programs can run. These hardening steps significantly raise the cost of fileless attacks without requiring any additional software.

The bigger picture: fileless malware is a real and growing threat, but it's important to maintain perspective. The vast majority of successful attacks against home users don't use sophisticated fileless techniques — they use phishing, credential theft, and social engineering. Fileless attacks are more commonly used against corporate targets where the payoff justifies the sophistication. For home users, the most important defenses remain the basics: keep software updated, use strong unique passwords, enable two-factor authentication, and be skeptical of unexpected emails and attachments. A security product with behavioral detection is a valuable additional layer, but it's not a substitute for good security hygiene.