[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fTk2guNTwxeKxz7lZ1X1xW8fGDkS7zFa7E1BaFg9WVg0":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":25,"status":26,"created_at":27,"published_at":28,"article":29,"tags":33,"podcasts":52,"controls":53},"4dd0908a-52e5-4801-b825-f0218b48af71","fileless-phishing-campaign-bypasses-defenses-to-deploy-rats-and-stealers","29714542-5634-4ad7-a287-61f084da446e","Fileless Phishing Campaign Bypasses Defenses to Deploy RATs and Stealers","The 'TFF Trap' campaign demonstrates how threat actors are layering multiple evasion techniques — including fileless execution and custom loaders — to slip past traditional security controls and deliver credential-harvesting malware. Because fileless attacks operate in memory rather than on disk, conventional antivirus and endpoint detection tools frequently fail to flag malicious activity before damage is done. The delivery of multiple RATs (Agent Tesla, Remcos, XWorm) suggests a well-resourced, adaptive adversary focused on persistent access and data exfiltration. This matters because Business Email Compromise (BEC) attacks enabled by stolen credentials can result in significant financial loss, regulatory exposure, and long-term network compromise. Organizations relying solely on perimeter defenses or signature-based detection are particularly vulnerable to this style of campaign.","**Immediate actions:**\n- Deploy or tune email security gateways to inspect and sandbox all attachments and URLs before delivery to end users.\n- Enable memory-based threat detection and behavioral analysis on all endpoints to catch fileless malware that evades signature scanning.\n- Block execution of unsigned scripts and macros via application control policies (e.g., AppLocker or Windows Defender Application Control).\n\n**Long-term improvements:**\n- Implement phishing-resistant Multi-Factor Authentication (MFA) on all user accounts to limit the impact of credential theft.\n- Conduct regular, role-targeted security awareness training that includes simulated BEC and phishing scenarios to build employee recognition skills.\n- Adopt a Zero Trust architecture that enforces least-privilege access so that compromised credentials yield minimal lateral movement opportunity.\n\n**Detection measures:**\n- Establish centralized SIEM logging with alerts tuned for anomalous process injection, in-memory script execution, and unusual outbound C2 traffic patterns.\n- Implement Network Detection and Response (NDR) tooling to identify RAT command-and-control beaconing across east-west and north-south traffic.\n- Regularly review and correlate email header anomalies, failed login attempts, and new persistence mechanisms as part of a continuous threat-hunting program.",[12,13,14,15,16,17,18,19,20,21,22,23,24],"CIS Control 9 – Email and Web Browser Protections","CIS Control 10 – Malware Defenses","CIS Control 13 – Network Monitoring and Defense","CIS Control 14 – Security Awareness and Skills Training","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 SI-4 – System Monitoring","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 IA-5 – Authenticator Management (MFA)","NIST CSF DE.CM-1 – Network Monitoring","MITRE ATT&CK T1566 – Phishing","MITRE ATT&CK T1059 – Command and Scripting Interpreter (Fileless)","MITRE ATT&CK T1055 – Process Injection","GDPR Article 32 – Security of Processing (breach risk mitigation)",{},"published","2026-07-20T20:20:24.14164+00:00","2026-07-20T20:20:23.783+00:00",{"id":7,"url":30,"slug":31,"title":32},"https:\u002F\u002Fwww.darkreading.com\u002Fendpoint-security\u002Fattackers-combo-evasion-tactics-bec-phishing","attackers-combo-up-evasion-tactics-for-bec-phishing-a42216","Attackers Combo Up Evasion Tactics for BEC Phishing",[34,40,46],{"id":35,"name":36,"slug":37,"description":38,"color":39},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":41,"name":42,"slug":43,"description":44,"color":45},"182e11d5-57c4-444e-8ec8-4682ad60261b","Incident Response","incident-response","Slow detection, poor containment, missing playbooks","#14b8a6",{"id":47,"name":48,"slug":49,"description":50,"color":51},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[],[54,58,62],{"slug":55,"name":56,"problem":57},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":59,"name":60,"problem":61},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":63,"name":64,"problem":65},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]