Academy
TermTechnique

Fileless malware

Malicious code that runs through legitimate tools and memory without writing a persistent file to disk.

Flow

  1. 1Command runs
  2. 2Code downloaded
  3. 3Unpacked in memory
Related families
MacSync Stealer, Lumma Stealer
MITRE ATT&CK
T1620 · Reflective Code Loading
Sources
7 sources
01

Overview

In fileless chains, the first step is often a command: code fetched from the internet with PowerShell, mshta or AppleScript is loaded directly into memory. No file is left on disk to scan. MITRE ATT&CK

“Fileless” is not an absolute term; part of the chain usually touches the disk. The real difference is that detection shifts from file scanning to process and command monitoring. MITRE ATT&CK

02

How it works

  1. 1

    Command runs

    The user or a document starts a short script command. MITRE ATT&CK

  2. 2

    Code downloaded

    The script fetches the actual payload from the internet. MITRE ATT&CK

  3. 3

    Unpacked in memory

    The payload is loaded and run in memory without being written to disk. MITRE ATT&CK

03

Real-world examples

MacSync: piped straight to osascript

MacSync Stealer profile

Zscaler documented that in the MacSync chain the downloaded content was passed directly to osascript and left no file trace on the system. Zscaler

Lumma: a command from the Run dialog

Lumma Stealer profile

According to a CISA and FBI advisory, in Lumma distribution a fake CAPTCHA asks the user to open the Windows Run dialog and paste the command in the clipboard. CISA and FBI (AA25-141B)

04

How to detect it

  • PowerShell, mshta or osascript fetching and running content from the internet. MITRE ATT&CK
  • Executable code regions in memory with no counterpart on disk. MITRE ATT&CK
05

What to do

  • Enable PowerShell script logging; block mshta and unnecessary script interpreters. MITRE ATT&CK
06

MITRE ATT&CK

T1620Reflective Code LoadingT1059.001PowerShellT1059.002AppleScriptT1105Ingress Tool Transfer
07

Related families and terms

Families

MacSync StealerActiveLumma StealerActive

Report

Infostealer Threat Report — October 2026

Terms

Living off the landInfection chainEndpoint detection and response
08

Sources

  1. 1Reflective Code Loading (T1620) · MITRE ATT&CK
  2. 2PowerShell (T1059.001) · MITRE ATT&CK
  3. 3AppleScript (T1059.002) · MITRE ATT&CK
  4. 4Ingress Tool Transfer (T1105) · MITRE ATT&CK
  5. 5ClaudeFix: shared Claude chats meet ClickFix · Zscaler, 2026
  6. 6Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations · CISA and FBI (AA25-141B), 2025-05-21
  7. 7Behavior Prevention on Endpoint (M1040) · MITRE ATT&CK
From the Essential plan

Infostealer Detection

See your firm's attack surface on one screen: how many findings, at which severity, on which domain.

View productCompare plans