TrickBot Adopted New Windows 10 UAC Bypasses to Elevate and Steal Credentials

TrickBot was updated to abuse Windows User Account Control on multiple versions of Windows, letting the malware launch with elevated privileges without showing a visible prompt. Researchers reported that the trojan used the fodhelper.exe auto-elevation technique on Windows 10 and CMSTPLUA on Windows 7, then quickly shifted to a newer Windows 10 bypass that abused wsreset.exe through registry changes under HKCU\Software\Classes. The changes allowed TrickBot to run more quietly, evade user suspicion, and weaken host defenses while maintaining administrative access.

The malware’s expanded privilege-escalation capability supported a broader credential-theft and post-compromise toolkit already seen in earlier TrickBot campaigns. Fortinet’s analysis of the pwgrab module showed TrickBot stealing saved passwords, browser data, autofill information, and credentials from applications including Outlook, FileZilla, and WinSCP, while persisting through scheduled tasks and exfiltrating data over HTTP. Reporting also noted TrickBot’s ability to spread laterally, target Active Directory data on domain controllers, and provide access that could later be used to deploy Ryuk ransomware.