Fileless malware is one of the most dangerous attack types out there — it never writes to your hard drive, lives entirely in RAM, and can steal your credentials before your antivirus has any idea it's there. In this episode, I bring in Dr. Mike Saylor — my co-author on Learning Ransomware Response & Recovery — to break down exactly how this attack works, why it's so hard to detect, and what you can actually do to protect yourself.

Mike walks us through how fileless malware hides in memory, how bad guys maintain their foothold even after a reboot by modifying registry keys or rewriting the operating system itself, and why the ArcGIS attack is a perfect real-world example — attackers sitting undetected inside a network for two years. We also get into MFA, specifically why a lot of MFA setups are done wrong, why passkeys are the better answer, and when it's time to bring in an EDR or XDR tool.

Fair warning: the action items here are a bit more advanced than our usual stuff. Think of this as the 401k conversation — don't have it before you've built your emergency fund. But this is stuff you absolutely need to know.

00:01:26 - Welcome & intro

00:04:43 - What is fileless malware?

00:09:16 - How fileless malware achieves persistence (ArcGIS case study)

00:15:02 - Can fileless malware spread beyond one machine?

00:16:43 - Defending yourself: MFA done right

00:20:38 - Why passkeys beat MFA

00:23:00 - EDR and XDR explained

00:28:03 - How modern EDR tools detect fileless malware

00:30:01 - Wrap-up and action items