Loading story…
Multiple reports describe abuse of the Microsoft-signed fodhelper.exe binary to bypass Windows User Account Control on Windows 10 by hijacking the per-user registry path HKCU\Software\Classes\ms-settings\Shell\Open\command. In the documented technique, an attacker sets a malicious default command and an empty DelegateExecute value so that fodhelper.exe, which auto-elevates, launches attacker-controlled code with high integrity. Public proof-of-concept examples showed the method spawning elevated cmd.exe or PowerShell sessions, and noted that the bypass generally requires the user to already belong to the local Administrators group.
The same technique was later observed in a phishing campaign analyzed by SANS, where a malicious Word document used embedded OLE objects instead of macros to trigger a batch file on victim systems. That script checked for Windows 10, attempted UAC bypass via fodhelper.exe and eventvwr.exe, then downloaded additional payloads from attacker-controlled infrastructure including 23.98.155.192 and hpsj.firewall-gateway.net. The infection chain ultimately deployed the Octopus backdoor, which used HTTP-based command and control with AES-encrypted communications and supported victim reporting, file download, PowerShell reset, and arbitrary command execution.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
cocomelonc published a C/C++ proof of concept showing how to create HKCU\Software\Classes\ms-settings\Shell\Open\command, set an empty DelegateExecute value, and launch fodhelper.exe to obtain an elevated cmd.exe session. The post also noted that Glupteba malware has used the technique for privilege escalation.
SANS ISC analyzed a malicious Word document used in a targeted phishing campaign that relied on embedded OLE batch files instead of macros. The batch script checked for Windows 10, attempted UAC bypass via fodhelper.exe and eventvwr.exe, then downloaded additional payloads that led to an Octopus backdoor.
PentestLab documented the fodhelper.exe UAC bypass and published a PowerShell proof of concept that creates the ms-settings registry keys, launches fodhelper.exe, and removes the keys afterward. The post also noted Bash Bunny and Metasploit implementations of the same technique.
The fodhelper.exe UAC bypass technique was discovered by winscripting. The method abuses per-user registry keys under HKCU\Software\Classes\ms-settings\shell\open\command so fodhelper.exe runs attacker-controlled commands with high integrity on Windows 10.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
cocomelonc.github.io
Open sourceisc.sans.edu
Open sourcepentestlab.blog
Open sourcewinscripting.blog
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**TrickBot** was updated to abuse Windows User Account Control on multiple versions of Windows, letting the malware launch with elevated privileges without showing a visible prompt. Researchers reported that the trojan used the **`fodhelper.exe`** auto-elevation technique on Windows 10 and **CMSTPLUA** on Windows 7, then quickly shifted to a newer Windows 10 bypass that abused **`wsreset.exe`** through registry changes under **`HKCU\Software\Classes`**. The changes allowed TrickBot to run more quietly, evade user suspicion, and weaken host defenses while maintaining administrative access. The malware’s expanded privilege-escalation capability supported a broader credential-theft and post-compromise toolkit already seen in earlier TrickBot campaigns. Fortinet’s analysis of the **`pwgrab`** module showed TrickBot stealing saved passwords, browser data, autofill information, and credentials from applications including **Outlook**, **FileZilla**, and **WinSCP**, while persisting through scheduled tasks and exfiltrating data over HTTP. Reporting also noted TrickBot’s ability to spread laterally, target Active Directory data on domain controllers, and provide access that could later be used to deploy **Ryuk ransomware**.
Aug 15, 2026
Elastic Security Labs’ analysis of roughly 100,000 Windows malware samples found **defense evasion** to be the most common ATT&CK tactic, followed by privilege escalation, execution, and persistence. Frequently observed behaviors included Windows Defender tampering, process injection, DLL side-loading, parent-PID spoofing, abuse of `Rundll32` and `Regsvr32`, malicious MSI installers, and NTDLL unhooking. Commodity malware increasingly used UAC-bypass techniques—including methods that abuse Windows’ trust in protected directories—alongside TrustedInstaller impersonation, elevated parent-process spoofing, and bring-your-own-vulnerable-driver activity. Security teams should prioritize behavioral detections for these elevation and evasion patterns, as well as monitoring for script hosts, WMI, scheduled tasks, Run keys, services, and credential-store access that commonly accompany malware execution and persistence.
Aug 26, 2026
A public GitHub repository exposes a PowerShell proof-of-concept for bypassing Windows User Account Control (UAC) by abusing the Microsoft Connection Manager Profile Installer, `cmstp.exe`. The script generates an `.inf` file, launches `cmstp.exe` with the `/au` option, waits for the installer window to become active, and then uses simulated keystrokes to confirm execution, allowing a payload to run in an elevated context without a standard UAC prompt workflow. The repository attributes the technique to Oddvar Moe and indicates the code was forked by Tyler Applebaum, with comments describing possible stealth refinements and customizable command execution. A second referenced page appears unrelated to the UAC bypass activity and does not add material technical detail to the event, leaving the GitHub proof-of-concept as the primary source describing the exposed bypass method.
Aug 15, 2026