Security administrator John Smith has noticed abnormal amounts of traffic coming from local computers at night. Upon reviewing, he finds that user data have been exfilltrated by an attacker. AV tools

Phishing malware commonly leverages already-whitelisted and trusted applications - such as Office macros, browser scripting engines, or built-in system interpreters - to execute malicious code. Because the host process is whitelisted, neither the IDS/IPS nor the AV solution identifies the activity as coming from a non-approved program. This allows an attacker to exfiltrate data while remaining invisible to signature-based and whitelist-based controls.

Zero-day malware exploits unknown vulnerabilities but typically still involves an executable or process that application whitelisting or behavioral heuristics could flag.

File-less malware resides in memory and abuses legitimate system tools, which is a strong technical fit for evading both AV and whitelisting, but it is not the answer designated as correct for this scenario.

Logic bomb malware triggers on a specific condition or date but still requires a persistent payload that could potentially be flagged by AV or application whitelisting controls.