We analyzed a fileless QAKBOT stager possibly connected to the recently reported Squirrelwaffle campaign.