Introduction to Malware Development — 0x01 Process Injection (Local & Remote)

Discover Waiting Thread Hijacking, a novel process injection technique that bypasses EDR systems. Learn how it stealthily executes code in remote processes.

Hallo saya Ahmad Renaldy Priono saya adalah Analisis Keamanan Siber dan Bug Hunter. Kali ini saya akan membahas tentang Process Injection…

NullGate offers a modern way to use NTAPI with indirect syscalls, FreshyCalls for dynamic retrieval, and a novel technique to bypass Windows Defender memory scanning.

ZigStrike, a new shellcode loader in Zig, offers advanced injection techniques and anti-sandbox features to bypass EDR, providing stealthy execution via local/remote thread and memory mapping.

Splunk uncovers XWorm's evolution: a modular RAT now delivering LockBit ransomware. It uses flexible delivery, AMSI/ETW bypasses, and process injection to evade detection.

Process injection is an advanced penetration testing technique used by skilled security professionals to stealthily insert malicious code…

Process injection is an advanced penetration testing technique used by skilled security professionals to stealthily insert malicious code…

A new report reveals a multi-stage phishing campaign distributing DarkCloud Stealer. The malware hides its loader in a JPG file and injects code into MSBuild.exe for stealth.

MissionEvasion is a powerful new tool for Windows that uses advanced process hollowing and overwriting techniques to bypass defenses and inject code.

Self process injection occurs when a program loads or executes a malicious payload in its own address space (rather than writing to or…

Despite a recent doxxing attempt, Lumma Stealer has resurfaced, integrating browser fingerprinting into its C&C to collect WebGL/Canvas signatures for sandbox evasion and victim assessment.

K7 Labs exposed a Python malware using multi-layer encoding (Base64/BZ2/Zlib) and a PNG-disguised RAR archive. The payload executes in memory and achieves stealth by injecting into cvtres.exe.

SEQRITE exposed Operation DUPEHIKE targeting Russian HR with a malicious LNK bonus lure. The DUPERUNNER implant uses PowerShell and process injection into explorer.exe to deploy the Adaptix C2 Beacon.

KittyLoader is a highly evasive loader written in C / Assembly. Features Hijacks early execution by replacing the C runtime entrypoint (__scrt_common_main_seh) with custom assembly. Hides all modu…

DbgNexum is a 2026 PoC that uses Hardware Breakpoints and File Mapping to inject shellcode without standard APIs, making it invisible to most EDRs.

Silver Fox APT targets users with fake LINE installers delivering ValleyRat. New campaign uses rare "PoolParty" injection to evade detection.

Siber güvenlik dünyasında artık klasik ‘dosya tabanlı’ zararlı yazılımların geçerliliği azaldı. Bugün EDR sistemlerini atlatabilmenin yolu…

How threat actors abuse process tracing to rewrite executable instructions in volatile RAM, and how modern EDRs detect memory modification…