Fileless Malware: Why It Evades Antivirus and How to Defend Against It

Fileless malware does not drop a file on your disk. It runs inside memory and rides on tools already built into your operating system, so the scanner looking for a malicious file finds nothing to flag. Security vendors now tie fileless techniques to roughly seven in ten serious malware incidents. The threat you need to stop leaves no file behind, and your antivirus was built to catch files.

Traditional defence works on a simple idea. A malicious program arrives as a file, the antivirus matches it against known signatures, and the file gets quarantined. Fileless attacks break this model. The attacker never writes a program to disk. Instead they load code straight into memory and drive legitimate system tools to do the damage. Nothing on disk means nothing for a signature scan to catch.

What fileless malware is

Fileless malware is an attack method where the malicious code lives in memory rather than in a file saved to storage. The attacker abuses trusted software already present on the machine: PowerShell, Windows Management Instrumentation, the registry, scheduled tasks, and scripting engines. Security teams call this approach living off the land, because the attacker lives off the resources your system already supplies. Defenders and researchers label these built-in tools LOLBins, short for living-off-the-land binaries. The attacker needs no new file, so the usual file-based alarm never sounds.

How a fileless attack unfolds

Entry often starts the same way other attacks do. A user opens a phishing attachment or clicks a malicious link, and a script runs. From there the attack stays in memory. The script calls PowerShell to pull down more code, writes an entry into the registry for persistence, and uses built-in administration tools to reach other machines. Stolen credentials carry the attacker from host to host, each step wearing the face of normal admin work. In 2026, CrowdStrike reported 82 percent of its detections involved no malware file at all, with attackers leaning on valid accounts and trusted system processes. The intrusion looks like routine activity, so it buys the attacker time inside your network.

Why it slips past antivirus

Signature scanning asks one question: does this file match a known bad pattern? A fileless attack gives it nothing to read. The malicious logic sits in memory and disappears on reboot, and the tools doing the work are signed, trusted parts of the operating system. Blocking PowerShell outright is not an option, because your administrators rely on it every day. The Canadian Centre for Cyber Security, in joint guidance with allied agencies on identifying and mitigating living-off-the-land techniques, warns these methods let an attacker blend into ordinary system behaviour and defeat defences built around file signatures. The same guidance points to state actors pre-positioning inside critical infrastructure using this approach.

Why Canadian organizations should pay attention

The threat is not theoretical for Canadian business. Statistics Canada found about one in six Canadian businesses hit by a cyber security incident in 2023, with recovery spending doubling to 1.2 billion dollars. The same survey shows a weakness fileless attacks exploit directly: only 46 percent of businesses monitor their network and system activity, and the share of firms with dedicated cyber security staff fell to 50 percent. Fileless malware hides inside normal behaviour. If no one watches the behaviour, the attack runs unseen. Large firms, the most targeted at 30 percent, hold the logs and the tools to spot it, but the signal means nothing without a trained team reading it.

How you defend against it

You stop watching for files and start watching for behaviour. Turn on detailed logging for PowerShell, command-line activity, and script engines, so a sudden burst of encoded commands stands out. Apply application control and allow-listing, a core recommendation in CCCS guidance, to limit which tools run and under what conditions. Enforce least privilege, so a stolen account reaches little. Segment the network to stop lateral movement at each border. Endpoint detection and response watches what processes do rather than what files contain, which is the shift fileless attacks demand. And feed all of it to people who know the difference between an admin script and an attacker wearing one.

Build the skills these attacks demand

Tools surface the signal, but trained analysts decide what it means. The Certified Cybersecurity Analyst program builds the monitoring and triage skills to read process and command-line activity and tell routine admin work from an intruder abusing it. The Certified Professional Ethical Hacker track teaches the living-off-the-land methods attackers use, so your defenders recognize them in the logs. When an attack lands, the Certified Incident Handling Engineer path prepares your team to contain it, trace the memory-resident activity, and remove the foothold. For oversight, the Certified Information Systems Security Officer program equips managers to set logging policy, fund detection, and weigh the risk. Mile2 ties each course to a real role, so your people apply the skills the day they return.

Fileless malware wins by looking like your own systems at work. You take the advantage away by watching behaviour and training the people who read the alerts. Log the activity attackers need, limit the privileges they inherit, and treat unexpected use of built-in tools as a signal worth chasing. An attack leaving no file still leaves a trail, and a prepared team follows it.