Loading story…
Researchers detailed a series of local privilege-escalation attacks against antivirus and EDR products that abused COM hijacking to load attacker-controlled DLLs into trusted front-end processes and then pivot into privileged back-end services. The work showed a recurring design weakness: low-privileged user-facing components were allowed to issue powerful requests to SYSTEM services over named pipes or RPC without sufficient validation. In one generalized attack pattern, modified backend messages were used to write attacker-controlled registry values and alter application paths so that a privileged security process later launched code from a user-writable location, yielding SYSTEM access.
Product-specific cases expanded that pattern across multiple vendors. AVG Internet Security (CVE-2024-6510) was exploited by combining COM hijacking, RPC abuse, self-defense disabling, and a TOCTOU race to swap in a malicious DLL for execution as SYSTEM; Webroot Endpoint Protect (CVE-2023-7241) exposed a file-deletion primitive over \\.\pipe\WRSVCPipe that was chained into DLL hijacking for a SYSTEM shell; Check Point Harmony (CVE-2024-24912) allowed a privileged service to download a DLL to an attacker-chosen path for lock-screen DLL hijacking; and Bitdefender Total Security (CVE-2023-6154) let a privileged backend write arbitrary registry values, enabling service ImagePath hijacking. The findings echo earlier research on brittle hardening controls in products such as VirtualBox, where COM registration abuse and DLL-loading edge cases also undermined process protections.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Neodyme detailed a privilege-escalation vulnerability in Bitdefender Total Security, tracked as CVE-2023-6154, in which COM hijacking and reversed IPC allowed a low-privileged attacker to make a privileged service write arbitrary registry values. The proof of concept changed NetSetupSvc's ImagePath and then started the service to execute attacker code as SYSTEM.
Neodyme published details of two local privilege-escalation vulnerabilities discovered via COM hijacking: Webroot Endpoint Protect (CVE-2023-7241) and Check Point Harmony (CVE-2024-24912). In both cases, trusted front-end processes were hijacked and then used to reach privileged backend functionality that enabled SYSTEM-level code execution.
Neodyme described a privilege-escalation vulnerability in AVG Internet Security, tracked as CVE-2024-6510, that combined COM hijacking, RPC abuse, and a TOCTOU race to gain SYSTEM privileges. The attack abused backend functions to disable self-protection and load a malicious DLL through an allow-listed system component.
Neodyme published research describing a general privilege-escalation method that uses COM hijacking to load attacker code into trusted front-end security-product processes and then abuse their communication with SYSTEM back-end services. The post included an example where modified messages caused a privileged back-end to write attacker-controlled registry values, leading to SYSTEM execution after reboot.
Silent Signal published research on breaking antivirus protections, contributing to the broader body of work on weaknesses in security-product self-protection and trust boundaries. The reference provides only the publication date anchor from the URL path.
On 2017-08-01, James Forshaw of Google Project Zero published analysis of three distinct bypass techniques against Oracle VirtualBox's Windows process hardening. The post detailed how the protections could be circumvented to inject arbitrary code into protected VirtualBox processes.
Google Project Zero said Oracle addressed two more VirtualBox process-hardening bypasses, CVE-2017-10204 and CVE-2017-10129, in VirtualBox 5.1.24. The bypasses exploited DLL loading edge cases and SMB image-section caching behavior to enable arbitrary code injection into protected processes.
Google Project Zero reported that Oracle fixed a VirtualBox Windows process-hardening bypass as CVE-2017-3563 in VirtualBox versions 5.0.38 and 5.1.20. The issue involved abusing per-user COM registration and Microsoft-signed components to inject code into protected VirtualBox processes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
neodyme.io
Open sourceneodyme.io
Open sourceneodyme.io
Open sourceneodyme.io
Open sourcegoogleprojectzero.blogspot.com
Open sourceblog.silentsignal.eu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Windows attackers have used **Component Object Model (COM) hijacking** to gain persistence by altering Registry entries so legitimate applications load attacker-controlled code during normal execution. MITRE documents the technique as `T1546.015`, noting that adversaries can replace COM object references or abuse **TypeLib** keys to redirect execution to malicious DLLs, scripts, or even remotely hosted payloads via the `script:` moniker. The approach is designed to survive reboots while blending into routine system activity, especially when attackers choose COM objects that are invoked often enough to ensure execution but not so critical that failures immediately expose the compromise. Public examples show both proof-of-concept and criminal use. A technical walkthrough demonstrated creating a user-level `HKCU\Software\Classes\CLSID\{...}\InprocServer32` entry so a process such as **Firefox** would load a malicious DLL instead of falling back to system-wide COM registrations, illustrating how COM hijacking can provide persistence and defense evasion. In the wild, the **W32.Silon** banking trojan reportedly replaced a CLSID reference for Microsoft-signed `msimtf.dll` with a malicious `msjet51.dll`, causing **Internet Explorer** to load the payload, steal online banking credentials, hide artifacts, and exfiltrate captured data to command-and-control servers.
Aug 15, 2026
Multiple public write-ups detailed how Windows service and RPC design flaws enabled **local privilege escalation**, **sandbox escape**, and in some cases reliable code execution. Research on the Windows SSDP service linked `FC_BINDING_CONTEXT` misuse to **CVE-2025-48815**, showing that a context handle from one RPC interface could be passed into another interface expecting a different type and ultimately abused to call `CloseHandle` on an unintended handle. Separate analysis of the Windows telephony service described **CVE-2024-26230** as a use-after-free in `tapisrv` caused by improper ownership validation of RPC-managed objects, allowing a dangling pointer to be reclaimed with attacker-controlled data and steered toward `LoadLibraryW` despite **XFG** protections. Earlier Windows RPC research also covered Storage Service bugs **CVE-2019-0983** and **CVE-2019-0998**, where file-copy, directory, and ACL logic exposed through RPC could be abused to overwrite privileged files or alter their security descriptors. Other disclosures showed the same pattern across Windows subsystems. Analysis of **CVE-2022-22715** in `npfs.sys` demonstrated that malformed `LOCAL\` named pipe paths could trigger integer overflow and out-of-bounds kernel writes, enabling escape from the Adobe Reader **AppContainer** sandbox and escalation to kernel read/write. Research into **CVE-2021-1648** in `splwow64` described bypasses in printer-handle validation and an arbitrary address read, while older work on **CVE-2018-8550** examined COM `DfMarshal` abuse for elevation of privilege through privileged unmarshaling paths. Related reporting also highlighted Microsoft hard-link mitigations and a Citrix restricted-desktop breakout that relied on allowed scripting components rather than a zero-day, underscoring how weak validation, unsafe object handling, and incomplete execution controls repeatedly exposed high-impact privilege boundaries on Windows.
Aug 3, 2026
Microsoft patched two actively exploited vulnerabilities in Microsoft Defender and related protection components, including **CVE-2026-41091**, a high-severity local privilege escalation flaw that can give an attacker **`NT AUTHORITY\SYSTEM`** privileges, and **CVE-2026-45498**, a medium-severity denial-of-service issue that can make Defender unavailable. The affected products include Microsoft Malware Protection Engine version **1.1.26030.3008 and earlier** and Microsoft Defender Antimalware Platform version **4.18.26030.3011 and earlier**, and both CVEs were added to CISA’s **Known Exploited Vulnerabilities** catalog due to active exploitation in the wild. Technical analysis of **CVE-2026-41091**, dubbed **RedSun**, says the bug lies in Windows Defender’s file remediation workflow when it processes malicious files marked as Cloud Files placeholders. A standard user can abuse Defender’s SYSTEM-level file operations, together with **NTFS junctions** and **oplocks**, to redirect a privileged write into **`C:\Windows\System32`**, plant a malicious binary such as **`TieringEngineService.exe`**, and then trigger execution through Storage Tiers Management COM activation to obtain a SYSTEM shell. Microsoft said the issues were fixed through automatic updates and urged organizations that disable auto-updates to manually update Defender and any products using the same engine and platform components.
Jul 24, 2026