# Fileless Malware: The Attack That Lives in Memory

Page: https://stenobird.com/podcast/the-backup-wrap-up-758069/fileless-malware-the-attack-that-lives-in-memory
Text version: https://stenobird.com/podcast/the-backup-wrap-up-758069/fileless-malware-the-attack-that-lives-in-memory.md
Podcast: [The Backup Wrap-Up](https://stenobird.com/podcast/the-backup-wrap-up-758069)
Published: 2026-03-23T11:00:00+00:00
Episode link: https://www.backupwrapup.com/fileless-malware-attack-lives-in-memory-leaves-no-trace
Audio file: https://episodes.captivate.fm/episode/f11f4ccc-f98a-4734-b9f1-8ea866f30f4b.mp3
Processing state: not_requested
JSON: https://stenobird.com/v1/public/podcasts/the-backup-wrap-up-758069/episodes/fileless-malware-the-attack-that-lives-in-memory
Duration seconds: 1923

## Resource

Fileless malware is one of the most dangerous attack types out there — it never writes to your hard drive, lives entirely in RAM, and can steal your credentials before your antivirus has any idea it's there. In this episode, I bring in Dr. Mike Saylor — my co-author on Learning Ransomware Response & Recovery — to break down exactly how this attack works, why it's so hard to detect, and what you can actually do to protect yourself. Mike walks us through how fileless malware hides in memory, how bad guys maintain their foothold even after a reboot by modifying registry keys or rewriting the operating system itself, and why the ArcGIS attack is a perfect real-world example — attackers sitting undetected inside a network for two years. We also get into MFA, specifically why a lot of MFA setups are done wrong, why passkeys are the better answer, and when it's time to bring in an EDR or XDR tool. Fair warning: the action items here are a bit more advanced than our usual stuff. Think of this as the 401k conversation — don't have it before you've built your emergency fund. But this is stuff you absolutely need to know. 00:01:26 - Welcome & intro 00:04:43 - What is fileless malware? 00:09:16 - How fileless malware achieves persistence (ArcGIS case study) 00:15:02 - Can fileless malware spread beyond one machine? 00:16:43 - Defending yourself: MFA done right 00:20:38 - Why passkeys beat MFA 00:23:00 - EDR and XDR explained 00:28:03 - How modern EDR tools detect fileless malware 00:30:01 - Wrap-up and action items

## Actions

- request_transcript: `POST https://stenobird.com/v1/public/podcasts/the-backup-wrap-up-758069/episodes/fileless-malware-the-attack-that-lives-in-memory/transcription-requests` — Idempotently request low-priority transcript generation for this episode.
- read_markdown: `GET https://stenobird.com/podcast/the-backup-wrap-up-758069/fileless-malware-the-attack-that-lives-in-memory.md` — Read the agent-friendly Markdown representation of this episode resource.

A page view does not enqueue transcription. Agents should invoke `request_transcript` explicitly when they need this episode processed.

## Transcript

Full transcripts are not published on public pages unless there is a clear rights basis.