In 2026, the most dangerous hackers no longer use classic viruses to infect your computer. They have adopted a much subtler strategy called "Living off the Land" (LotL). It involves using programs already installed in your operating system — legitimate tools such as PowerShell or Command Prompt — to carry out the attack. At Altanet Craiova we have noticed that these incidents are the hardest to detect, because the antivirus only sees "trusted" programs running normal operations.
According to the CrowdStrike 2026 report, most advanced attacks today are "fileless" (no malicious files on disk). Hackers no longer install anything; they simply give new commands to the programs you already use every day to run your business.
Why are LotL attacks invisible to classic methods?
Your traditional antivirus looks for virus signatures, that is, files that "look" dangerous. In a "Living off the Land" attack, there is no new file at all. The attacker gets into the network (often with stolen credentials) and starts using system applications to steal data or to spread to other computers.
It is as if a burglar did not bring their own crowbar to break down the door, but found the key forgotten under the doormat and used the tools you already have in your garage to open the safe. To an outside observer, it looks like the homeowner is doing ordinary repairs. This perfect camouflage lets an attacker stay in a company's network for weeks without being discovered.
The signs of an attack without malware
Even though they are extremely discreet, LotL attacks leave traces that specialists can identify:
- Unusual activity in system programs: Processes such as PowerShell running at odd hours or connecting to unknown internet addresses.
- High resource consumption: Legitimate applications that suddenly start using a lot of memory for no clear reason.
- Changes in security settings: Silent disabling of logging or system alerts.
- Creation of new administrator accounts: Using network tools to generate permanent access rights for attackers.
How do you defend against an attack that uses your own tools?
To stop these "invisible" threats, Altanet Craiova recommends a change of strategy, from scanning files to monitoring behaviour:
- Implement EDR (Endpoint Detection and Response) solutions: They don't look for viruses, but analyse suspicious actions by legitimate programs.
- Limit access to administrative tools: Only qualified IT staff should be able to run PowerShell or Command Prompt; disable them for the rest of your employees.
- Zero Trust policy: Don't assume an action is safe just because it comes from an official Windows application.
- Audit system logs: Reviewing the logs periodically can reveal strange commands executed in the background.
Conclusion
The biggest security gap in 2026 is the idea that if you haven't found any viruses, you are safe. "Living off the Land" attacks teach us that our own systems can be turned against us. Being vigilant means understanding how your computers work and watching any activity that falls outside the normal pattern.
This article is part of the Altanet series on cyber threats in 2026. Next article: Routers and Firewalls: The Hidden Weaknesses in Your Equipment. See also the complete guide to the series.