Objective
Not long ago, antivirus software acted like a digital gatekeeper. Try to save a file, and it would check the hash, allow or block, based on reputation.
Security has come a long way since then. Most organizations now recognize that true protection requires a layered stack, not a “set-it-and-forget-it” EDR.
But while defenders have been busy preparing for yesterday’s breach, adversaries have been evolving. Their tradecraft has matured. Their tooling is modular. Their operations are scaled and refined.
Today, a single typo in your browser, one wrong letter in a familiar URL, can cost you every saved password you’ve ever stored. Or worse, your entire cryptocurrency wallet.
And it can all happen in seconds. No files written to disk. No antivirus alerts. No trace.
This research documents the infrastructure and execution model behind one such campaign, and maps where detection opportunities actually exist.
From scripts to systems: how info-stealers evolved
The fall of the single binary
Historically, info-stealers were monolithic. Persistence, payload, and exfiltration were all compiled
into a single binary, an .exe or .dll. These static payloads were easy to detect via hashes or
signatures, and they often logged to disk, making them traceable.
Modern threats are modular, resilient, and adaptable. The kill chain is decomposed into loosely coupled stages, each with minimal detectable behavior. Initial access is followed by in-memory execution, modular loading, and real-time retooling. Nothing is static.
Worse yet, adversaries now leverage legitimate system components to remain invisible. With LOLBINs
(Living Off the Land Binaries, trusted OS tools like certutil.exe or powershell.exe), it’s possible
to execute the entire chain in memory using only trusted OS tools and infrastructure. When additional
tools are required, trusted resources such as the Python interpreter or Java runtime are installed by
the scripts themselves.
Malware that never touches disk
Legacy malware relied on disk operations: dropping files, creating registry keys, writing logs. These actions were relatively easy for AV and EDR tools to detect.
Modern malware rarely touches the disk. Fileless techniques dominate, leveraging PowerShell, WMI, and interpreted languages. Encrypted payloads are decoded and executed directly in memory. No executables, no logs.
A more dangerous shift: Malware as a Service
While these fileless tactics have challenged defenders for years, the true danger lies in how adversaries have scaled, not just their tools, but their business models.
Malware-as-a-Service (MaaS) is a subscription model where payloads are updated and supported like SaaS platforms. Adversaries design, publish, market, and support malware infrastructures for their customers, reducing the skill needed to enter the criminal enterprise.
Past campaigns relied on volume: spam bombing, static C2s, and brute-force techniques. These were loud and quickly neutralized by blacklists and EDR vendors. Today’s attackers use:
- Rotating domains (e.g. typosquatting)
- Targeted phishing
- MaaS platforms with customizable payloads and logic
Some platforms even log infection metrics, not to steal data, but to track conversion rates. Malware now ships with built-in analytics, providing value to their operations as well as their customers.
This shift isn’t just strategic, it’s architectural. The malware isn’t just malicious code anymore. It’s a product.
Core takeaway Adversaries now build malware like software vendors build apps. Their platforms are modular, scalable, and often include built-in reporting.
Behind the curtain: building the modern malware stack
Modern malware infrastructure is stunning in its complexity. Typosquatting and social engineering remain common, but they’re just the tip of the spear. Today’s infrastructure often includes:
- Fly-by-night C2s with multi-function endpoints
- Separate delivery, exfiltration, and counter-tracking mechanisms
- Legitimate services (e.g.
python.org,pip) used to build the infection stack
A recent C2 domain I observed provided three core components:
- Counters. Track victim callbacks for infection metrics.
- Exfil endpoints. Receive encrypted payloads from victims.
- Payload delivery. Serve encrypted files and decryption keys for in-memory execution.
These payload components are downloaded at runtime and never touch the disk.
The agent: a fileless visitor with a flexible mission
This agent doesn’t live on your machine. It visits. It borrows your memory. And quietly steals your passwords and cryptocurrency.
Here’s how it works:
1. Initial dropper. Via social engineering, a PowerShell script is executed by the user. The dropper then pulls additional resources from public repositories such as GitHub or file-sharing services.
2. Environment setup. Once the resources are retrieved, the malware searches for existing Python
or Java installations. If missing, it installs interpreters from trusted sites like python.org. This
adds stealth. No suspicious downloads, just “developer tools,” which are common in many environments.
3. Payload execution. An .enc file (encrypted payload) and a .key file (decryption key) are
pulled from C2 infrastructure. These files are not saved to disk; their contents are streamed directly
into memory. The script decrypts and executes the payload using the interpreter.
4. No disk touchpoints. No logs, no binaries, no residual footprint. Even exfiltrated data is processed and transmitted from memory.
5. Dynamic adaptation. Every time the agent runs, it fetches the latest payload. Adversaries can change tactics on the fly without requiring a new infection.
How we stand a chance
Locard’s exchange principle tells us that when two objects come into contact, there is an exchange of materials.
In cybersecurity, the same is true: when adversaries interact with our systems, they leave behind traces. Those traces may not be files or binaries, but behaviors, patterns, and signals.
By aligning this principle with a deep understanding of attacker tradecraft, we gain a blueprint for detecting and interrupting the kill chain, not through wishful prevention, but through observable interactions across our environment.
To meet this challenge, our tools must be tuned before the breach. The right telemetry must already be flowing, and our detections must map to attacker logic, not just atomic events.
Defensive takeaway
By taking a few intentional steps to better understand the landscape, both internal and external, we can begin to tip the scales in our favor. Approaches worth considering:
- Implement telemetry pipelines that align with kill chain stages
- Monitor memory-based execution (e.g. parent-child process anomalies)
- Use cyber threat intelligence to track evolving MaaS infrastructure
- Apply detection logic to interpreter installation and “developer tool” downloads
Findings
Defenders have improved, but so have their adversaries. Today’s threat actors wield generative AI, modern software engineering, and agile development models. They eliminate single points of failure, test against CTI feeds, iterate rapidly, and deploy evasive variants with ease. Once detection hits, they rotate infrastructure, change signatures, or repackage payloads.
So how do defenders keep up? The answer lies in mirroring the adversary’s architecture with one of our own.
The days of a single security solution or signature-based detection are over. We as cyber defenders must shift our focus from signatures to behavior. Without understanding what is normal or expected in our environments, we have little chance of maintaining control.
In a world where malware mirrors legitimate enterprise design, defenders must think like engineers, not gatekeepers.
Behavior is the new signature.
Next Steps
- Build detection logic against interpreter installation events and first-run behavior.
- Track the observed C2’s rotation cadence to establish infrastructure age as a signal.
- Feed observed indicators into an enrichment pipeline rather than a static blocklist.