MSBuild.exe is emerging as a high‑value LOLBin that enables stealthy, fileless intrusions on modern Windows systems by abusing trusted developer tooling rather than dropping obvious malware binaries.
MSBuild (Microsoft Build Engine) is a legitimate Microsoft‑signed component used to build .NET applications from XML‑based project files such as .csproj. Because it ships with Windows and Visual Studio, security tools and allow‑listing policies usually treat it as a trusted process.
Attackers exploit three key properties.
- Inline C# execution: Project files can embed C# code that MSBuild compiles and runs directly, so adversaries can execute payloads without writing a standalone EXE to disk, enabling fileless behavior in memory.
- Built‑in functionality: MSBuild can load files, perform network communications, and build and launch binaries, giving attackers a flexible post‑exploitation tool without importing extra utilities.
- Signed LOLBin profile: As a Microsoft‑signed binary, MSBuild.exe helps adversaries bypass naive signature checks and some application control rules that only look at the parent process name or certificate.
In January 2025, a published proof of concept showed that a malicious MSBuild project could establish a TCP reverse shell on Windows 11 while Windows Defender real‑time protection remained silent, demonstrating practical AV evasion with no explicit malware file on disk.
In this test, the main. csproj project compiled main.cs into main.exe and immediately executed it, with the C# code loading shellcode that connected back to the attacker’s machine.
Real‑world MSBuild Campaign and Defenses
In February 2026, researchers documented a phishing campaign in which MSBuild served as a downloader for PlugX, combining MSBuild abuse with DLL sideloading to deliver the payload stealthily.
Victims received email attachments masquerading as meeting invitations or business documents; inside the archive, a legitimately signed executable and a project file were bundled together, with the executable renamed to resemble a document and reduce suspicion.
According to Asec research, when the user launched the “document,” MSBuild’s behavior automatically loaded a co‑located .csproj file without any obvious command‑line flags, making the operation appear benign to both users and basic monitoring.
The embedded inline C# script contacted attacker‑controlled URLs (stored as Base64 strings), downloaded three payloads into temporary directories with random file names, and then executed the first binary, while also dropping a specially named DLL and data file for later sideloading.
Because the first binary was also signed and apparently legitimate, defenders would only see a normal process loading a DLL from its own directory, which is a common pattern abused by DLL sideloading to run malicious code in memory.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
