A reflective loader is malware code that loads a payload directly into memory instead of handing it to a normal installer or operating-system loading path. In practice, the loader may decrypt, map, and start the next stage from a buffer it controls, often without writing a visible file to disk.
This matters because fileless or memory-resident execution can reduce the clues defenders rely on, such as new executables on disk, standard installation events, or obvious parent-child process patterns. Reflective loaders are common in multi-stage intrusions: one component drops or fetches the loader, and the loader then launches the real payload in memory. Analysts often detect it by watching for suspicious memory allocation, thread injection, unusual module loading, and processes that make outbound connections soon after starting. Defenses that combine EDR telemetry, script and process monitoring, and memory analysis are better positioned to catch this technique.