Malware in 2026: The Family Tree, the Fileless Threat, and How to Hunt It

Your antivirus scans for signatures. The dangerous stuff doesn't have any.

Your antivirus scans for known malware signatures. In 2026, the most dangerous malware doesn't have files. Doesn't have signatures. It lives in memory, uses your own operating system's tools against you, and disappears when you reboot.

Here's the malware family tree, what each type actually does, and how the hunting has evolved.

The malware family tree

Malware is the umbrella. Under it, the types behave very differently, and that difference determines how you find them.

Viruses attach to a legitimate file and need a host to spread. You run the infected program, and the virus runs with it. Pure viruses are now rarer than other types.

Worms self-propagate. No host needed. They spread across networks on their own, exploiting vulnerabilities or misconfigurations. The behavior of WannaCry, Conficker, and NotPetya worms is what made them global.

Trojans disguise themselves as something legitimate. You install what you think is a PDF viewer, a game, or a security tool. What runs is the Trojan. The point is voluntary installation by the victim.

Rootkits burrow deep. They modify the operating system itself, often at the kernel level, to hide their presence. A traditional antivirus running in userspace can't see them because the rootkit intercepts the calls before the AV gets an honest answer.

Spyware collects keystrokes, screenshots, browsing history, and credentials. Runs quietly, exfiltrates data.

RATs (Remote Access Trojans) give the attacker interactive control. Live keyboard, live camera, live file system. It's like the attacker is sitting at your computer.

The 2026 evolution: fileless and LOLBins

Traditional malware writes a file to disk. The antivirus scans the file, checks its hash against known signatures, and quarantines it if it is flagged. That whole model assumes there's a file to scan.

Fileless malware doesn't drop a file. It lives entirely in memory. The initial payload might come from a malicious document or a phishing email, but what executes loads directly into memory. When you reboot, it's gone. When you check the file system, you find nothing.

Living Off the Land (LOLBins). Instead of dropping their own tools, attackers use what's already on your system: PowerShell, WMI, PsExec, certutil, and mshta. Every one of these is a legitimate Windows utility. When an attacker uses PowerShell to download and execute an in-memory payload, your EDR sees it as a signed Microsoft binary executing PowerShell.

Polymorphic and metamorphic malware. Polymorphic changes its outer wrapper each time it runs, so signature-based detection fails. Metamorphic rewrites its actual code. AI-assisted malware pushes this further: code adapts to the environment it lands in, evading whatever detection it senses.

How SOC analysts hunt malware

If your only signal is antivirus alerts, you're missing the interesting stuff. Modern hunting is behavioral.

Process analysis. Parent-child relationships tell the story. Word documents don't normally spawn PowerShell. PowerShell doesn't normally spawn cmd, which doesn't normally spawn certutil to download a payload. Chained together, these are exploitation signatures.

EDR behavioral detection. Modern endpoint tools watch process injection, credential access, unusual network connections from unusual binaries, and DLL side-loading. CrowdStrike, SentinelOne, and Microsoft Defender for Endpoint all build detections around behavior chains.

Memory analysis. When fileless malware is your target, you have to look at memory. Volatility is the classic open-source tool. You're looking for injected code, hollowed processes, and command lines that don't match the running executable.

Network indicators. Beaconing patterns, e.g., regular, small outbound connections at consistent intervals, are the fingerprint of C2 traffic. DNS queries to newly registered domains. Encrypted traffic to IPs that don't resolve to a known service.

Persistence mechanisms. When malware wants to survive reboots, it has limited places to hide: Registry Run keys, scheduled tasks, Windows services, WMI event subscriptions, and startup folders. The MITRE ATT&CK framework catalogs the techniques learned.

Defense in depth for malware

Email and web filtering. Most malware arrives through email attachments or drive-by downloads. Sandbox attachments. Strip macros from Office documents.

Application allowlisting. Only approved software runs: Windows Defender Application Control, AppLocker, and third-party tools. Operationally hard, which is why most organizations don't do it, but where it's implemented, it defeats a huge percentage of malware.

Least-privilege access. Users don't need admin. When accounts get compromised, the attacker inherits those privileges. Limited privileges = limited blast radius.

Aggressive patching. LOLBins get exploited through unpatched vulnerabilities. Fileless techniques often rely on legacy configurations. Patching closes entire families of attacks.

Sandboxing. Cuckoo Sandbox for self-hosted; ANY.RUN or Joe Sandbox for cloud-based analysis of suspicious files.

EDR with memory scanning. If your endpoint tool doesn't inspect memory, fileless malware wins by default. Make sure yours actually looks past the file system.

Incident response. Isolate the endpoint. Collect a forensic image before you reimage. Analyze what happened. Remediate the root cause, not just the symptom.

Bottom line

Malware in 2026 is fileless when it can be, LOLBin-driven when it needs to hide, and AI-assisted to evade detection. But the fundamentals hold: behavioral detection over signatures. Least privilege over trust. Application control over free-for-all. Memory analysis when the file system is empty.

The organizations catching modern malware aren't running better antivirus software. They're watching behavior.

Want the checklist? Download the Malware Hunting Cheat Sheet - process tree red flags, memory analysis quick reference, and the LOLBin watch list. Enter your email, and it's yours.

Watch the video version with all the visuals: ATK-03 on YouTube.

Coming next: ATK-04 - DDoS Attacks: Taking Down Networks at Scale. Subscribe to catch it.