Fodhelper UAC Bypass Abused in Windows Privilege Escalation and Octopus Malware Delivery

Multiple reports describe abuse of the Microsoft-signed fodhelper.exe binary to bypass Windows User Account Control on Windows 10 by hijacking the per-user registry path HKCU\Software\Classes\ms-settings\Shell\Open\command. In the documented technique, an attacker sets a malicious default command and an empty DelegateExecute value so that fodhelper.exe, which auto-elevates, launches attacker-controlled code with high integrity. Public proof-of-concept examples showed the method spawning elevated cmd.exe or PowerShell sessions, and noted that the bypass generally requires the user to already belong to the local Administrators group.

The same technique was later observed in a phishing campaign analyzed by SANS, where a malicious Word document used embedded OLE objects instead of macros to trigger a batch file on victim systems. That script checked for Windows 10, attempted UAC bypass via fodhelper.exe and eventvwr.exe, then downloaded additional payloads from attacker-controlled infrastructure including 23.98.155.192 and hpsj.firewall-gateway.net. The infection chain ultimately deployed the Octopus backdoor, which used HTTP-based command and control with AES-encrypted communications and supported victim reporting, file download, PowerShell reset, and arbitrary command execution.