This post is part of a series on credit union cybersecurity. Read more here.
When most people imagine a cyberattack, they picture a virus quietly installing itself on a computer, running in the background, and eventually getting caught by antivirus software. That image made sense for a long time, but the threat landscape has shifted in a way that makes that mental model dangerously outdated.
In 2025, 82% of cyberattacks detected by CrowdStrike involved no malware at all. That’s up from 51% just five years ago. Attackers have learned that the fastest way past a modern security stack is not to bring their own tools, but to use yours.
The implications of this trend matter for every organization, but credit unions are hit especially hard. Tight IT teams, vendor-heavy environments, and an expanding regulatory spotlight make the “we have antivirus” assumption one of the most expensive mistakes an institution can make.
What Malware-Free Actually Means
When attackers avoid malware entirely, they are not limiting themselves. They are simply using the tools and credentials that were already on your machine, knowing that no scanner will flag activity that looks like normal administrative work.
Think about the software your organization uses every day. Remote access tools, scripting environments like PowerShell, cloud administration portals, network management utilities. These are all legitimate, necessary, and trusted by your security systems. Attackers know this, and they can exploit that trust.
The technique is sometimes called “living off the land.” An attacker gains initial access through a phishing email, a stolen password, or a vulnerable internet-facing device. They then move through the network using the same tools your IT team would use, generating the same kinds of logs and blending into the noise of a normal workday.
How the Initial Access can Happen
These breaches usually begin with one of these three entry points:
- Stolen credentials, the most common kind of malware-free attack. A username and password acquired through a phishing email, a data breach at another company, or credential-stuffing attacks can give an attacker authenticated access to your email, cloud environment, or VPN. Once they are logged in, they look indistinguishable from a legitimate user.
- Phishing without a payload. Modern phishing attacks do not always rely on malicious attachments. A link to a convincing login page, a prompt to approve a multi-factor authentication request, or a business email compromise that routes a wire transfer are all effective and don’t involve any malware being executed.
- Exploitation of edge devices. Firewalls, VPN concentrators, and network appliances often run specialized operating systems that do not support traditional endpoint protection. Attackers exploit unpatched vulnerabilities in management interfaces or abuse built-in protocols like SSH and SNMP to execute code that already lives on the device, leaving no foreign file for a scanner to find. CrowdStrike found that 40% of the vulnerabilities exploited by sophisticated threat actors in 2025 targeted exactly these kinds of devices, specifically because they lack comprehensive monitoring.
Credit unions are particularly exposed on this front. Many institutions rely on equipment provided or managed by their core processor or a generalist IT provider that does not monitor these devices at the depth that regulators increasingly expect.
What Happens After They Get In
This is where the absence of malware becomes most consequential. Once an attacker has a foothold, they begin what security professionals call lateral movement. Using existing infrastructure like built-in scripting tools, they explore the network, map out where sensitive data lives, identify backup systems, and quietly escalate their privileges.
In 2025, the fastest attacker that CrowdStrike observed moved from initial access to attempting data exfiltration in four minutes. The average was 29 minutes. Traditional security approaches that rely on detecting malware signatures have no visibility into this kind of activity because there is nothing unusual to detect.
By the time the damage is visible, an attacker may have been inside the environment for days or weeks. They may have already copied member data, mapped out your backup infrastructure, or positioned themselves to deploy ransomware at a moment of their choosing.
Why This Matters for NCUA Exams and Compliance
The regulatory implications compound the operational ones. NCUA examiners are no longer satisfied with knowing that antivirus is deployed. They want to see evidence of continuous monitoring, documented incident response execution (not just a plan sitting in a folder), and defensible logging that would surface anomalous behavior even when no malware is present.
That standard requires visibility into user behavior, identity activity, and network telemetry, not just file-level scanning. Most credit unions under $500 million in assets do not have that capability in place, and many do not realize the gap exists until an examiner points to it.
What Effective Defense Actually Looks Like
Stopping malware-free attacks requires a different kind of security posture. It starts with the assumption that credentials will be compromised and that legitimate tools will be abused.
Multi-factor authentication, particularly phishing-resistant forms like hardware keys or passkey-based authentication, reduces the value of stolen passwords significantly. Identity threat detection watches for unusual authentication patterns, impossible travel, or privilege escalation that deviates from normal behavior. SIEM platforms correlate logs across the entire environment so that the subtle signals of lateral movement become visible even without a malicious file to flag.
Perhaps most importantly, 24/7 monitoring with a human response capability closes the window that attackers rely on. A security operations center that is watching at 2:00 AM on a Sunday can interrupt an intrusion that would otherwise go undetected until Monday morning.
The Honest Summary
The security threat landscape has evolved. Attackers that forego malware are faster and more effective at hiding in plain sight. Security programs built around detecting malicious files are defending against the attacks of a decade ago.
For credit unions, the stakes include member data, regulatory standing, cyber insurance coverage, and board confidence. The question worth asking is not whether antivirus is installed. It is whether anyone would know if a legitimate set of credentials was being used by the wrong person, right now, inside your environment. That answer requires a different kind of visibility than most institutions currently have.