In this blog, we are going to see how the APC Queue Injection works and write our code to execute the payload. I recommend you to read my…

Beware of cracked software and fake installers. Discover how cybercriminals exploit user trust and spread malicious payloads.

What is Process Hollowing?

Introduction to Malware Development — 0x01 Process Injection (Local & Remote)

Discover Waiting Thread Hijacking, a novel process injection technique that bypasses EDR systems. Learn how it stealthily executes code in remote processes.

Hallo saya Ahmad Renaldy Priono saya adalah Analisis Keamanan Siber dan Bug Hunter. Kali ini saya akan membahas tentang Process Injection…

NullGate offers a modern way to use NTAPI with indirect syscalls, FreshyCalls for dynamic retrieval, and a novel technique to bypass Windows Defender memory scanning.

ZigStrike, a new shellcode loader in Zig, offers advanced injection techniques and anti-sandbox features to bypass EDR, providing stealthy execution via local/remote thread and memory mapping.

Splunk uncovers XWorm's evolution: a modular RAT now delivering LockBit ransomware. It uses flexible delivery, AMSI/ETW bypasses, and process injection to evade detection.

Process injection is an advanced penetration testing technique used by skilled security professionals to stealthily insert malicious code…

Process injection is an advanced penetration testing technique used by skilled security professionals to stealthily insert malicious code…

A new report reveals a multi-stage phishing campaign distributing DarkCloud Stealer. The malware hides its loader in a JPG file and injects code into MSBuild.exe for stealth.

MissionEvasion is a powerful new tool for Windows that uses advanced process hollowing and overwriting techniques to bypass defenses and inject code.

Self process injection occurs when a program loads or executes a malicious payload in its own address space (rather than writing to or…

Despite a recent doxxing attempt, Lumma Stealer has resurfaced, integrating browser fingerprinting into its C&C to collect WebGL/Canvas signatures for sandbox evasion and victim assessment.

K7 Labs exposed a Python malware using multi-layer encoding (Base64/BZ2/Zlib) and a PNG-disguised RAR archive. The payload executes in memory and achieves stealth by injecting into cvtres.exe.

G DATA exposed Arkanix, a fast-evolving C++ stealer. Its premium version uses process injection and Chrome Elevator to bypass Chrome App-Bound Encryption (ABE) and steal crypto wallets and Wi-Fi passwords.