Attackers Bypass EDR by Using In-Memory PE Loaders Delivered via Malicious Downloads

Security researchers have identified a wave of attacks that bypass endpoint detection and response by using in-memory PE loaders delivered via malicious downloads. In these campaigns, a small downloader is delivered to victims through malicious links or attachments, then fetches a full PE file from a remote server and maps it directly into the memory of a trusted process, running without ever touching disk.

This approach makes the payload run inside a trusted process and often evades detection by traditional antivirus and EDR tools, since no malicious executable is written to disk and many steps appear benign. According to the report, recent campaigns have delivered these in-memory loaders through weaponised email attachments, fake software updates, and compromised websites.

Victims are tricked into launching a downloader that pulls a larger PE payload from a cloud storage link or GitHub repository, enabling tools such as remote access Trojans or credential stealers, with investigators sometimes finding it difficult to recover evidence because there is no on-disk artefact.

Defenders are urged to combine telemetry sources, monitor for unusual API calls, enforce strict application allowlists, deploy memory-scanning tools, and conduct regular threat hunting to detect and respond to these file-less techniques.