Security administrator John Smith has noticed abnormal amounts of traffic coming from local computers at night. Upon reviewing, he finds that user data have been exfilltrated by an attacker. AV…

Phishing malware describes a delivery method via deceptive communications, not a memory-resident execution technique that bypasses whitelisting.

Zero-day malware exploits an unpatched vulnerability but typically still involves a file or process artifact that a whitelisting solution could potentially flag as unauthorized.

Fileless malware does not write executable files to disk - instead it hijacks trusted built-in tools such as PowerShell, WMI, or mshta to load and run malicious code directly in memory. Because no new binaries are dropped, signature-based antivirus has no file to scan and application whitelisting finds no unauthorized executables, allowing the malware to exfiltrate data undetected as seen in this scenario.

A logic bomb is code that triggers on a specific condition and is usually embedded within an existing file or script, giving whitelisting and AV tools a potential artifact to detect.