Fileless malware explained: how attackers operate without files and how to stop them

Key insights

  • Fileless malware abuses trust, not vulnerabilities. Attackers leverage legitimate OS tools like PowerShell, WMI, and .NET to execute malicious code in memory, evading signature-based detection entirely.
  • The threat spans Windows, Linux, and cloud environments. Recent campaigns — EggStreme, ShadowHS, DEAD#VAX — demonstrate that fileless techniques now target every enterprise attack surface, including containers and serverless functions.
  • Traditional antivirus cannot detect fileless attacks. With no malicious files to scan, organizations must deploy behavioral analysis across endpoints and networks to identify the anomalous process behaviors and communication patterns these attacks generate.
  • Process injection is the number one MITRE ATT&CK technique. According to the Picus Red Report 2026, T1055 tops the list across 1.1 million malware samples analyzed, and 80% of the top 10 techniques focus on defense evasion.
  • Layered detection is the only reliable defense. Combining endpoint detection and response with network detection and response and behavioral analytics closes the visibility gaps that fileless malware exploits.

Fileless malware is among the fastest-growing and most evasive threat categories facing security teams today. Unlike traditional malware that drops executable files to disk, fileless attacks abuse trusted operating system tools — PowerShell, WMI, .NET — to execute malicious code directly in memory. The result is an attack that leaves minimal forensic artifacts, bypasses signature-based antivirus, and blends seamlessly with legitimate system activity. According to the Ponemon Institute's 2017 State of Endpoint Security Risk study, fileless attacks were approximately 10 times more likely to succeed than file-based attacks — a finding that, while dated, remains the most cited benchmark because no updated study has replaced it. More recent data shows the problem is accelerating. Fileless malware attacks have increased 78% from 2024 to 2026, and fileless and in-memory techniques have risen approximately 30% year-over-year. This guide provides a comprehensive, evidence-based look at how fileless malware works, the real-world campaigns shaping the current threat landscape, and the layered detection strategies that actually work against memory-resident threats.

What is fileless malware?

Fileless malware is a category of malicious activity that uses native, legitimate tools built into an operating system — such as PowerShell, WMI, and .NET — to execute cyberattacks without writing traditional executable files to disk, operating primarily in memory through trusted system processes and evading signature-based detection.

That definition, while clear, oversimplifies a nuanced reality. The term "fileless" exists on a spectrum. Microsoft's authoritative fileless threat taxonomy classifies fileless threats into three types:

  • Type I — No file activity. The attack operates entirely in memory with no file system interaction. Process-injected shellcode and in-memory PowerShell scripts fall into this category. These attacks are lost on reboot unless paired with a separate persistence mechanism.
  • Type II — Indirect file activity. The attack uses legitimate file system artifacts — WMI repository entries, registry hive values — as storage but never drops a traditional executable. APT29's POSHSPY WMI backdoor is a classic example.
  • Type III — Files required to operate. The initial delivery uses files (macros, scripts, droppers) but the payload executes entirely in memory. Storm-0249's fileless ransomware chain fits here.

You may also encounter synonymous terms in the wild. Memory-only malware, non-malware attacks, zero footprint attacks, and living off the land (LOTL) techniques all describe overlapping concepts within this threat category. The key distinction is that fileless malware is a broader category, and LOTL is a specific technique subset within it.

Fileless malware is not a virus in the traditional sense. Traditional viruses replicate by attaching to files. Fileless malware operates through legitimate system processes, making it a fundamentally different threat category that demands different detection approaches.

Fileless vs traditional malware

Table: Key differences between fileless and traditional malware

Attribute Traditional malware Fileless malware Detection implication
Delivery Executable files (.exe, .dll) dropped to disk Legitimate tools (PowerShell, WMI) execute in memory Signature scanning catches traditional; behavioral analysis needed for fileless
Disk footprint Writes files that antivirus can scan Minimal or no disk artifacts File-based indicators of compromise are unreliable for fileless threats
Persistence Files, scheduled tasks, startup entries Registry keys, WMI subscriptions, memory injection Detection requires monitoring system configuration changes, not file creation
Forensic evidence File hashes, file paths, PE headers Process memory, event logs, network traffic Memory forensics and behavioral logging replace disk forensics
Evasion capability Moderate — requires obfuscation or packing High — blends with legitimate system operations 54% of companies struggle to detect attacks exploiting built-in OS tools (ControlD, 2026)

How fileless malware works

Fileless malware follows a multi-stage attack flow. Understanding each stage — and the tools attackers abuse — is essential for building effective detection.

Typical fileless attack chain:

  1. Initial accessPhishing email, exploit, or social engineering delivers the entry point
  2. Execution — PowerShell, WMI, or .NET loads malicious code directly into memory
  3. Persistence — Registry keys or WMI event subscriptions maintain access across reboots
  4. Lateral movement — Process injection and LOTL tools spread through the network
  5. Command-and-control and exfiltration — Encrypted channels carry stolen data out of the environment

PowerShell and scripting-based execution

PowerShell remains the primary fileless execution vehicle on Windows. Attackers use Base64-encoded commands piped directly into PowerShell to download and execute payloads without ever writing a file. The T1059.001 technique is one of the most commonly observed across real-world campaigns.

A typical pattern involves curl.exe or Invoke-WebRequest retrieving a script from a remote server and piping it directly into powershell.exe -EncodedCommand for in-memory execution. The Antimalware Scan Interface (AMSI) was designed to inspect these commands at runtime, but attackers continue to develop bypass techniques — making AMSI an important but imperfect defense layer.

WMI abuse adds another dimension. Attackers create WMI event subscriptions — permanent triggers that execute code when specific system conditions are met. APT29's POSHSPY backdoor stored encrypted PowerShell commands within the WMI repository itself, with a WMI filter triggering periodic execution. As Mandiant's analysis documented, this gave APT29 persistent, fileless access running as SYSTEM with no artifacts outside the WMI repository.

Process injection and memory-resident techniques

Process injection (T1055) is the single most prevalent MITRE ATT&CK technique. The Picus Red Report 2026, analyzing 1.1 million malware samples, ranked it number one — and found that 80% of the top 10 techniques focus on defense evasion, persistence, and command-and-control.

Attackers inject malicious code into the memory space of trusted running processes — RuntimeBroker.exe, svchost.exe, OneDrive.exe — so the malicious activity executes under the context of a legitimate, signed binary. The February 2026 DEAD#VAX campaign demonstrated this with four-layer obfuscation and process injection into trusted Windows processes, using IPFS-hosted VHD files to bypass Mark-of-the-Web protections entirely.

Registry-based persistence stores encoded payloads in registry keys, ensuring survival across reboots while keeping the payload out of the file system. DLL sideloading — where attackers place a malicious DLL alongside a legitimate, digitally signed application — has become a favored technique. Storm-0249 abused a SentinelOne signed binary for exactly this purpose, turning a security tool's own process into an attack vector.

Linux fileless techniques

Fileless malware is no longer a Windows-only problem. Linux environments — which host the majority of enterprise cloud workloads — face their own set of fileless techniques:

  • memfd_create — A Linux system call that creates anonymous files in memory, returning a file descriptor that allows execution without touching the file system. The ShadowHS framework discovered in January 2026 uses memfd for its entire execution chain with AES-256-CBC encrypted payloads.
  • ptrace — A system call that allows one process to manipulate another's memory, enabling code injection on Linux similar to Windows process injection.
  • /proc/self/mem — Direct memory writes through the proc filesystem that enable payload modification of running processes.

The PostgreSQL fileless cryptomining campaign in April 2025 compromised over 1,500 servers using the memfd technique, demonstrating fileless attacks operating at commodity-cybercrime scale on Linux infrastructure. The attackers used per-target binary hash diversification to defeat reputation-based detection — a level of sophistication previously associated only with advanced persistent threats.

Types of fileless malware

Understanding the classification of fileless malware helps security teams build appropriate detection for each variant. The table below combines Microsoft's Type I/II/III taxonomy with technique-based categories and emerging cloud variants.

Table: Classification of fileless malware by execution type and persistence mechanism

Type Description Persistence Examples Detection approach
Type I — No file activity Fully memory-resident; no file system interaction None (lost on reboot unless paired with external persistence) Process-injected shellcode, in-memory PowerShell, infostealers running in process memory Memory scanning, behavioral monitoring, network traffic analysis
Type II — Indirect file activity Uses legitimate system artifacts (WMI repo, registry hives) WMI subscriptions, registry-stored payloads APT29 POSHSPY, registry-resident backdoors WMI subscription auditing, registry change monitoring, Sysmon logging
Type III — Files for initial access Dropper or script file required; payload runs in memory Script files plus in-memory execution Malicious macros, ClickFix social engineering, DLL sideloading chains Script Block Logging, AMSI, behavioral EDR
Exploit-based Vulnerability exploitation loads code directly into memory Depends on post-exploitation actions EternalBlue, browser exploits Patch management, network IDS, memory protection
Cloud and container Exploits container runtimes, serverless functions, cloud APIs Ephemeral by design; may abuse cloud IAM for persistence VoidLink, PyLoose, container runtime memfd exploitation Cloud security monitoring, runtime protection, cloud audit logs

Cloud-native and container fileless attacks

The expansion of fileless techniques into cloud environments represents a major content gap across the cybersecurity industry — and a rapidly growing threat. Cloud workloads are particularly vulnerable because containers are ephemeral by design, meaning traditional file-based scanning has limited value even for conventional malware.

Specific cloud fileless attack vectors include:

  • Container runtime exploitation — Attackers exploit container escape vulnerabilities to inject code into host memory via memfd_create, bypassing container isolation without writing files
  • Serverless function abuse — Malicious code injected into serverless function execution environments operates entirely in memory with no persistent storage
  • Cloud control plane attacks — Abusing cloud management APIs and stolen credentials to execute commands across cloud infrastructure without deploying files
  • Kubernetes security sidecar exploits — Injecting malicious containers as sidecars that execute payloads in memory

VoidLink, an AI-assisted cloud-native fileless framework discovered in January 2026, exemplifies this evolution. Built by a single developer with large language model assistance — reportedly producing roughly 88,000 lines of code — VoidLink targets cloud environments with fileless execution chains designed specifically to evade cloud workload protection platforms.

Fileless malware in practice

Real-world campaigns from 2025 and 2026 demonstrate how fileless techniques are deployed across every major attack surface. These examples — significantly more recent than the dated Poweliks (2014) and Kovter references found in most competing guides — reflect the current state of fileless threats.

Table: Recent fileless malware campaigns from 2025 to 2026

Campaign Date Target Key technique Lesson learned
EggStreme Sep 2025 Philippine military DLL sideloading, 58-command fileless framework Nation-state actors build purpose-built fileless frameworks that evade endpoint protection for months
Storm-0249 Dec 2025 Enterprise targets ClickFix + fileless PowerShell + DLL sideloading via signed EDR binary Even security tool binaries can become DLL sideloading vectors
ShadowHS Jan 2026 Linux infrastructure memfd execution, AES-256-CBC encrypted loader, EDR fingerprinting Fileless malware has expanded into Linux with automated EDR evasion
DEAD#VAX Feb 2026 Windows enterprise IPFS-hosted VHD, four-layer obfuscation, process injection Attackers use IPFS and VHD files to bypass Mark-of-the-Web protections
PostgreSQL mining Apr 2025 1,500+ PostgreSQL servers COPY FROM PROGRAM + memfd fileless miner, per-target hash diversification Fileless techniques are now used at commodity scale, not just by APTs

Fileless techniques in ransomware kill chains

The integration of fileless techniques into ransomware operations is accelerating. According to Recorded Future, publicly reported ransomware attacks rose to 7,200 in 2025 compared to 4,900 in 2024 — a 47% increase. Fileless malware variants in ransomware toolkits have increased 40% (Gitnux, 2026), and 93% of organizations have experienced at least one ransomware-ready intrusion in the past 24 months.

Storm-0249's December 2025 campaign illustrates the pattern. The attack chain uses ClickFix social engineering to trick users into running a PowerShell command. That command downloads and executes a fileless payload via curl.exe piped into PowerShell — no file ever touches disk. The payload then uses DLL sideloading through a legitimately signed security binary to establish persistence and deploy ransomware. Every stage before the final encryption payload leverages fileless techniques, making early detection dependent on behavioral analysis rather than file scanning.

Detecting and preventing fileless malware

Detecting fileless malware requires a fundamental shift from file-based to behavior-based security. Traditional antivirus — which relies on scanning files for known signatures — cannot detect code that never exists as a file. This is why 79% of targeted attacks in 2023 used living-off-the-land binaries (KnowBe4, 2025) and why 54% of attacker activity is logged but only 14% generates alerts (Picus Blue Report, 2025). The detection gap is real, but it is addressable with the right approach.

Behavioral indicators of fileless attacks

Behavioral threat detection monitors process behaviors, command parameters, and system changes rather than file signatures. The following indicators are specific to fileless malware activity.

Table: Behavioral indicators of fileless malware with detection mappings

Indicator Sysmon Event ID Detection tool MITRE technique
PowerShell executing encoded commands Event ID 4104 (Script Block Logging) SIEM, EDR T1059.001
WMI event subscription creation Event ID 19, 20, 21 Sysmon, EDR T1546.003
Process injection into trusted processes Event ID 8 (CreateRemoteThread) Sysmon, EDR T1055
Unusual parent-child process relationships Event ID 1 (Process Creation) Sysmon, SIEM Multiple evasion techniques
Registry modification of Run keys Event ID 13 (Registry Value Set) Sysmon, EDR T1027.011
Scheduled task creation via command line Event ID 4698/4699 Windows Security Log T1053.005

Network detection of fileless threats

Here is the critical insight that no other guide covers adequately. Fileless malware evades endpoint detection — that is its entire purpose. But fileless malware still generates network traffic. Every command-and-control communication, every lateral movement attempt, every data exfiltration event produces observable network behaviors.

Network detection and response (NDR) provides a complementary detection layer that catches what endpoint tools miss:

  • Beaconing pattern detection — Fileless implants must communicate with C2 infrastructure. NDR identifies periodic, structured outbound connections even when encrypted.
  • Unusual PowerShell-initiated connections — PowerShell processes making outbound HTTP/HTTPS connections to external infrastructure is anomalous in most environments.
  • Lateral movement traffic — Lateral movement via SMB, WMI, or WinRM generates distinctive network patterns detectable by NDR regardless of whether the executing process is fileless.
  • Encrypted C2 channel analysis — Even without decryption, NDR can identify suspicious encrypted traffic patterns based on timing, packet sizes, and destination behavior.

Combining EDR and NDR creates visibility across both the endpoint execution layer and the network communication layer — closing the gap that fileless malware exploits.

Prevention best practices

While no single control defeats fileless malware, the following measures significantly raise the cost for attackers:

  1. Enable PowerShell Script Block Logging (Event ID 4104) and Module Logging to capture all PowerShell execution
  2. Deploy PowerShell Constrained Language Mode via Windows Defender Application Control (WDAC) — this restricts access to .NET types and COM objects commonly abused by fileless malware, though bypass techniques exist (MSBuild, PowerShell v2 downgrade)
  3. Implement application allowlisting using WDAC or AppLocker to restrict which executables and scripts can run
  4. Restrict administrative tool access through least-privilege principles — limit who can run PowerShell, WMI, and other administrative tools
  5. Monitor WMI event subscriptions — legitimate WMI persistence is rare, so any new subscription warrants investigation
  6. Deploy NDR for network-level visibility into C2 communications and lateral movement
  7. Conduct proactive threat hunting for fileless indicators — unusual PowerShell network connections, unexpected WMI subscriptions, and process injection artifacts
  8. Segment networks to limit the blast radius of lateral movement following a fileless compromise

For incident response, remember that fileless malware demands volatile evidence collection. Memory forensics must be prioritized because disk forensics alone will miss the primary artifacts. Fileless-specific IR playbooks should include memory capture as a first-response action.

Fileless malware and MITRE ATT&CK

Mapping fileless techniques to the MITRE ATT&CK framework enables structured detection engineering. Rather than hunting for individual attacks, security teams can build detection coverage against the specific techniques fileless malware relies on — creating durable defenses that work against future campaigns, not just known ones. This approach aligns with the cyber kill chain methodology of disrupting attacks at every stage.

Table: MITRE ATT&CK techniques commonly used in fileless malware attacks

Tactic Technique ID Technique name Fileless relevance Detection data source
Execution T1059.001 PowerShell Primary fileless execution mechanism Script Block Logging (4104), Module Logging
Execution T1059.005 Visual Basic Macro-based initial access (declining due to default macro blocking) AMSI, Macro execution logs
Execution T1047 Windows Management Instrumentation Fileless execution and reconnaissance via WMI WMI Activity logs, Sysmon 19/20/21
Defense Evasion T1055 Process Injection Core fileless technique — code into legitimate process memory Sysmon 8 (CreateRemoteThread), memory scanning
Defense Evasion T1027.011 Fileless Storage Payloads stored in registry, WMI repo Registry monitoring (Sysmon 13), WMI auditing
Defense Evasion T1218.005 Mshta Mshta.exe abused for fileless payload execution Process creation logs, command-line auditing
Persistence T1546.003 WMI Event Subscription Fileless persistence via WMI triggers Sysmon 19/20/21, WMI Activity logs
Defense Evasion T1574.002 DLL Side-Loading Loading malicious DLLs via trusted signed binaries Module load monitoring, hash verification

Compliance considerations

Fileless malware defenses map directly to compliance requirements across major frameworks.

Table: Compliance framework crosswalk for fileless malware detection controls

Framework Control ID How fileless malware defense maps Evidence
NIST CSF DE.CM-4, PR.DS-6, PR.IP-1 Malicious code detection must extend beyond file scanning; baseline configurations should restrict PowerShell policies Behavioral detection logs, WDAC policies
CIS Controls v8 Controls 2, 4, 8, 10, 13 Software inventory (2), secure configuration (4), audit logging (8), behavioral malware defenses (10), network monitoring (13) Sysmon logs, WDAC config, NDR alerts
PCI DSS v4 Requirement 5 "All known types of malware" protection must include fileless variants Behavioral detection deployment evidence

Modern approaches to fileless malware defense

The detection landscape is evolving in response to fileless threats. Three converging trends are reshaping how organizations defend against memory-resident attacks.

First, XDR integration brings endpoint, network, and identity signals into a unified detection pipeline. Fileless attacks that evade any single detection layer still generate observable behaviors across multiple layers. Correlating an anomalous PowerShell execution on an endpoint with unusual outbound C2 traffic on the network produces a high-confidence signal that neither layer achieves alone.

Second, AI-driven behavioral analytics are maturing beyond simple rule-based detection. Organizations deploying AI-based defenses save an average of $1.9 million per breach compared to those without (security research aggregation, 2025). These systems learn baseline behaviors and flag deviations — exactly the approach needed against fileless threats that blend with legitimate operations.

Third, the threat itself is evolving. SecurityWeek's Cyber Insights 2026 analysis highlights AI-powered polymorphic fileless attacks as an emerging trend, with PromptFlux and PromptSteal representing the first confirmed LLM-querying malware families. VoidLink's use of LLM assistance in framework development — producing roughly 88,000 lines of code — signals that AI is lowering the barrier to creating sophisticated fileless tooling.

How Vectra AI approaches fileless malware detection

Vectra AI's approach to fileless malware detection centers on the assume-compromise philosophy and Attack Signal Intelligence. Rather than relying on signatures or file-based indicators, the platform analyzes behavioral patterns across network and cloud environments to identify the command-and-control communications, lateral movement, and data exfiltration that fileless attacks inevitably generate — even when endpoint detection tools are evaded. This network-level behavioral analysis, backed by 35 AI patents and 12 references in MITRE D3FEND, provides a critical detection layer that complements EDR coverage and closes the visibility gap fileless malware exploits.

Future trends and emerging considerations

The fileless malware landscape is entering a new phase driven by AI capabilities on both sides of the offense-defense equation. Over the next 12 to 24 months, security teams should prepare for several developments.

AI-powered fileless attacks will become more sophisticated and accessible. The discovery of PromptFlux and PromptSteal — the first confirmed malware families that actively query large language models during operation — signals a shift toward malware that adapts in real time. VoidLink demonstrated that a single developer with LLM assistance can produce enterprise-grade fileless frameworks. As these tools proliferate, the volume of fileless attacks will increase even as the skill level required to launch them decreases.

Cloud-native fileless techniques will accelerate. As organizations migrate more workloads to containerized and serverless environments, attackers will follow. Container runtime exploitation via memfd, cloud API abuse, and Kubernetes-focused attacks represent the next frontier of fileless malware. Organizations should evaluate their cloud workload protection strategies for visibility into memory-resident threats — not just file-based vulnerabilities.

Regulatory frameworks will tighten requirements for advanced threat detection. The EU's NIS2 directive and evolving PCI DSS v4 requirements are already expanding what constitutes adequate malware protection. Fileless-specific detection capabilities — behavioral analysis, memory scanning, network anomaly detection — will increasingly become compliance requirements rather than optional enhancements.

Memory-harvesting malware will emerge as a distinct threat category. As data increasingly resides in memory during processing (including sensitive AI model data), attackers will target memory contents directly — shifting from using memory as an execution environment to treating it as a data extraction target.

Organizations that invest now in layered behavioral detection — across endpoints, networks, and cloud environments — will be positioned to address these emerging threats without a full architectural overhaul.

Conclusion

Fileless malware represents one of the most significant detection challenges facing modern security operations. By abusing trusted operating system tools and executing entirely in memory, these attacks bypass the file-based detection that the security industry relied on for decades. The campaigns documented here — from EggStreme to ShadowHS to Storm-0249 — demonstrate that fileless techniques now span Windows, Linux, and cloud environments, and are used by both nation-state actors and commodity cybercriminals.

The defense is clear but requires deliberate investment. Organizations need layered behavioral detection that combines endpoint visibility with network-level analysis. Signature-based tools alone create a false sense of security. Behavioral analytics, NDR, proactive threat hunting, and structured MITRE ATT&CK coverage provide the comprehensive detection that fileless malware demands.

Security teams ready to close the fileless detection gap can explore how Vectra AI's Attack Signal Intelligence provides behavioral detection across hybrid and multi-cloud environments — finding the attacks that other tools miss.

Related cybersecurity fundamentals

FAQs

What is fileless malware?

How does fileless malware work?

Is fileless malware a virus?

Why is fileless malware hard to detect?

Can antivirus detect fileless malware?

How to prevent fileless malware attacks?

What is the difference between fileless and traditional malware?