CuraSec

tag: Process-Injection · 2 items

Plan archived AutoIT Used for Process Injection in Active Malware Campaigns
2026-07-28 · SANS ISC · source ↗ #malware#process-injection#autoit
  • Engineer — Learn: AutoIT’s scripting capabilities make it an easy vehicle for injecting payloads into remote processes; no patch exists for this technique, but understanding it may prompt reviewing whether AutoIT is needed in your environment or blocked in application allow-lists.
  • SOC/IR — Plan: This SANS ISC diary provides technical detail on AutoIT-based process injection worth translating into detection rules; consider adding Sigma/EDR detections for AutoIT spawning unusual child processes or performing remote thread injection.
  • Leader — Skip
Learn archived OkoBot Malware Injects Seed Phrase Phishing Into Ledger/Trezor Apps
2026-07-16 · The Hacker News · source ↗ #malware#crypto-wallet#process-injection
  • Engineer — Learn: OkoBot’s technique of injecting malicious UI into a legitimate, running desktop application without tampering with the binary is a relevant threat model for any desktop software you ship or review; no patch action exists on the defender side, but it informs how you think about process isolation and UI integrity for sensitive operations.
  • SOC/IR — Learn: The TTP — waiting for a specific USB device event to trigger an overlay inside a trusted process — is worth understanding for behavioral detection theory, but no IOCs or confirmed enterprise victim telemetry are provided, making active hunting premature.
  • Leader — Skip