Fileless malware is malicious code that runs entirely in a computer's memory, leaving no file on disk for antivirus to find. Instead of installing a program, it borrows tools already on the machine — PowerShell, Windows Management Instrumentation, macros — and does its damage inside trusted processes. This guide explains how fileless attacks work in 2026, why traditional antivirus misses them, and what stops them.
TL;DR
- Fileless malware runs in memory using legitimate system tools, so it writes nothing to disk for a scanner to flag.
- Its favourite vehicle is PowerShell and other built-in admin tools abused from a script or a malicious document.
- Detection shifts from signatures to behaviour: watch what scripts and processes do, not what files exist.
- Logging, restricted admin rights and staff awareness are the controls that catch it.
- Cyber Aware's phishing simulations target the click that starts every fileless chain.
What fileless malware means
Traditional malware is a file: an .exe or .dll that lands on disk, installs itself and waits. Antivirus was built to find files like that — match them against signatures, quarantine, done. Fileless malware skips the disk entirely. The malicious instructions arrive as a script, a command line or a memory injection and run inside a process the operating system already trusts.
The name is slightly misleading: something usually has to arrive to start the attack — often a macro-laden document or a registry entry that holds a payload. The defining trait is that the malicious activity itself leaves no executable file behind. The toolkit is whatever the machine already has, which is why this class is sometimes called LOTL — living off the land.
How a fileless attack works
A typical chain in 2026:
- Delivery. A phishing email carries a document, a shortcut file or a link to a script. The lure looks ordinary — an invoice, a "secure message", a shipping notice.
- The launch. The user opens it. A macro, or a click on the disguised link, invokes PowerShell or another built-in tool.
- In-memory execution. The payload is fetched straight into memory, or decoded from an encoded command string, and runs inside a trusted process. Nothing is written to disk.
- The objective. Credentials are lifted from memory, a reverse connection opens to the attacker, or a downloader pulls a second-stage payload that may itself be fileless.
- Persistence — the fileless twist. To survive a reboot without a file, the payload hides in the registry (a technique known as a Kovter-style registry payload), in scheduled tasks that re-run the script, or in a startup shortcut.
PowerShell is the star of this genre because it is present on every Windows machine, is a native administrator tool, and can download, decode and execute code in one line — all of it looking, to a casual observer, like routine IT activity.
Why antivirus misses it
| Traditional malware | Fileless malware |
|---|---|
| Malicious file lands on disk | Nothing malicious lands on disk |
| Matches a known signature | Built fresh from built-in tools |
| Runs as its own process | Runs inside a trusted process |
| Static scanning finds it | Needs behavioural detection |
| Evidence survives for forensics | Volatile — gone when memory clears |
Behavioural tools catch fileless activity by watching for the combination that legitimate work almost never produces: an office document spawning PowerShell, a script encoded to evade inspection, an admin tool reaching out to the internet. Endpoint detection products that monitor process lineage and script content are the answer — but they work only if deployed and monitored.
What fileless attacks cost a business
The outcome is identical to any other intrusion: stolen credentials, financial fraud, ransomware staged on the foothold. Fileless malware is a delivery technique, not a separate crime — and it suits targeted attackers because it evades the cheap defences and leaves little forensic trace.
The Australian context sizes the surrounding risk. The Australian Signals Directorate logged more than 84,700 cybercrime reports in 2024-25 — one every six minutes — with the average self-reported cost for a small business at $56,600, up 14 per cent (ASD Annual Cyber Threat Report 2024-25). A fileless intrusion that sits undetected for weeks is precisely the scenario that ends in one of those averages.
Signs of fileless activity
- PowerShell or WScript launching from Office documents or browsers — visible in process logs, not to the naked eye.
- Encoded command strings (long base64 blobs) in command lines.
- Admin tools making unexpected outbound network connections.
- Unexplained new scheduled tasks, registry run keys or startup entries.
- Accounts showing activity at hours nobody works, with no corresponding malware alerts — because there is no malware to alert on.
The uncomfortable truth: without process and script logging switched on, most fileless attacks leave almost nothing a small business can see after the fact.
How to stop fileless malware
- Switch on PowerShell script block logging and command-line auditing, and ship the logs somewhere someone actually reviews. This is the single highest-value control — it turns the attack's invisibility into evidence.
- Constrain PowerShell where possible: execution policies, Constrained Language Mode, and removing it from machines and accounts that never need it.
- Take admin rights away from daily accounts. Most fileless payloads need elevation to persist and do damage; a standard user account blunts the whole chain.
- Block macros from the internet by policy, and disable Office macros unless a document is genuinely needed and trusted.
- Deploy behaviour-based endpoint protection and keep it monitored — signatures alone cannot see this class.
- Patch everything. Fileless does not mean exploit-free: many chains start from a known vulnerability in the browser, Office or the email client.
- Train the entry point. Every fileless chain in the wild starts with a person opening the lure. Monthly security awareness training that rehearses document and link lures — and same-day remediation for anyone who clicks a simulation — cuts the infection chain at its only human step. Human risk reporting shows whether the click rate is actually falling.
Why this matters for Australian businesses
Frameworks assume the discipline fileless attacks punish. Essential 8's application control and restriction of administrative privileges, and SMB1001's expectations around endpoint hardening, all map directly onto the controls above. A cyber security gap assessment shows which of those are actually implemented across every machine — not just the servers — before an auditor or an attacker tests them.
FAQ
What is fileless malware in simple terms? Malicious code that runs in a computer's memory using built-in tools like PowerShell, leaving no infected file on disk. Antivirus that only scans files struggles to see it at all.
How does fileless malware get on a computer? Through phishing documents with macros, malicious links that run scripts, or exploitation of unpatched software. The payload then executes in memory inside a trusted process.
Can antivirus detect fileless malware? Signature-based scanning usually cannot. Behaviour-based endpoint protection can — it watches for trusted tools being abused, such as an Office document spawning PowerShell with an encoded command.
Does fileless malware survive a reboot? Only with a persistence trick: a registry payload, a scheduled task or a startup script that re-launches it. Those artefacts are small but findable if you know where to look.
Is PowerShell itself dangerous? No — it is a legitimate and widely used administration tool. The risk is unmonitored, unrestricted PowerShell on machines where nobody audits how it is used.
What is living off the land? The attacker's practice of using software already installed on the target — admin tools, scripts, utilities — instead of bringing their own malware, which makes the activity blend in with normal IT work.
One last thing
Check one thing today: whether PowerShell script block logging is on for your Windows machines. If it is off, a fileless attack would run on your network and leave nothing behind to investigate. Turning it on takes an afternoon and converts your most invisible attack class into your most traceable one.
Related guides
- What is a trojan? — the file-based cousin fileless attacks replace.
- What is malware? — the broader family, explained.
- Compare awareness platforms — how delivery models differ.