MSBuild.exe: The Stealthy Weapon in Fileless Attacks

Cyber attackers are increasingly leveraging Living Off the Land Binaries (LOLBins) to bypass modern security defenses. By weaponizing legitimate system tools, these attacks completely sidestep signature-based detection methods and operate without dropping traditional malware files, making them notoriously difficult to detect.Chief among abused LOLBins is MSBuild.exe, a native Windows development tool digitally signed by Microsoft. Originally designed for compiling C# projects from XML files, attackers have repurposed it to execute arbitrary payloads directly in memory—enabling fileless intrusions that leave minimal forensic traces.

Why Attackers Prioritize MSBuild

MSBuild offers attackers three critical advantages:

• Fileless Execution: Malicious C# code is embedded directly in XML project files (.csproj), eliminating the need for standalone executables and bypassing file-based security controls.
• Full System Access: Provides capabilities for file manipulation, network communication, and binary compilation—allowing flexible deployment of multi-stage attacks.
• Trusted Execution Chain: Microsoft’s digital signature automatically whitelists its activity in most endpoint solutions, rendering signature-based detection ineffective.

Real-World Abuse Cases

Early 2025 research by Michał Walkowski demonstrated MSBuild’s ability to bypass Windows Defender on Windows 11 using just two files: a C# source (main.cs) and project configuration (main.csproj). This technique compiles and executes reverse shell code entirely in memory, triggering no alerts despite real-time protection being active.

In February 2026, Lab52 uncovered a phishing campaign abusing MSBuild.exe to deliver PlugX malware. Attackers sent ZIP attachments disguised as meeting invitations containing a renamed MSBuild binary and malicious project file. Upon execution, MSBuild downloaded encoded payloads from attacker servers and used DLL sideloading to covertly activate PlugX via legitimate processes.