Loading story…
Windows attackers have used Component Object Model (COM) hijacking to gain persistence by altering Registry entries so legitimate applications load attacker-controlled code during normal execution. MITRE documents the technique as T1546.015, noting that adversaries can replace COM object references or abuse TypeLib keys to redirect execution to malicious DLLs, scripts, or even remotely hosted payloads via the script: moniker. The approach is designed to survive reboots while blending into routine system activity, especially when attackers choose COM objects that are invoked often enough to ensure execution but not so critical that failures immediately expose the compromise.
Public examples show both proof-of-concept and criminal use. A technical walkthrough demonstrated creating a user-level HKCU\Software\Classes\CLSID\{...}\InprocServer32 entry so a process such as Firefox would load a malicious DLL instead of falling back to system-wide COM registrations, illustrating how COM hijacking can provide persistence and defense evasion. In the wild, the W32.Silon banking trojan reportedly replaced a CLSID reference for Microsoft-signed msimtf.dll with a malicious msjet51.dll, causing Internet Explorer to load the payload, steal online banking credentials, hide artifacts, and exfiltrate captured data to command-and-control servers.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A cocomelonc tutorial demonstrated COM hijacking by creating an HKCU\Software\Classes\CLSID\...\InprocServer32 override for a CLSID queried by firefox.exe and pointing it to a custom DLL named evil.dll. The walkthrough reported that after restarting Firefox and waiting several minutes, the malicious DLL loaded, displayed a message box, and Firefox crashed once during testing.
A Contagio analysis described W32.Silon as a banking trojan that persisted by replacing the CLSID reference for Microsoft-signed msimtf.dll with a malicious DLL, msjet51.dll, causing the payload to load into Internet Explorer. The report also detailed credential theft, registry-stored configuration, process injection, and exfiltration behavior.
MITRE ATT&CK documented Component Object Model Hijacking as sub-technique T1546.015, describing registry-based hijacking of COM references for persistence and execution. The entry also noted a TypeLib variation that can use the "script:" moniker to fetch and run remote scripts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cocomelonc.github.io
Open sourcecontagiodump.blogspot.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers have identified new and stealthy techniques leveraging Microsoft’s Component Object Model (COM) and Distributed COM (DCOM) technologies for lateral movement and persistence within Windows environments. One report details the discovery of a previously undocumented DCOM object that can be abused for remote command execution and persistence by exploiting Control Panel items, highlighting both the technical mechanisms and detection strategies for defenders. The research also reviews the current state of tools like Impacket’s `dcomexec` script and discusses how adversaries enumerate and leverage COM objects for malicious purposes. In a separate breach assessment, investigators uncovered a threat actor using a ComHandler within Windows Scheduled Tasks to maintain long-term command-and-control access. The attacker deployed custom surrogate DLLs and targeted tasks named `User_Feed_Synchronization-{GUID}` to execute code, remaining undetected for at least seven months. This technique, tracked as UKC-1230, demonstrates the real-world application of COM-based persistence and the challenges defenders face in detecting such abuse, especially when attackers mimic legitimate system activity.
Jun 29, 2026
A series of public proof-of-concept posts detailed how attackers can establish persistence on Windows by abusing multiple native mechanisms, including `AppInit_DLLs`, COM hijacking, Windows services, logon scripts, file-association changes, uninstall handlers, Event Viewer help links, shell `CLSID` command handlers, and Accessibility Features such as Sticky Keys. The demonstrations showed malware-like code modifying keys under `HKLM` and `HKCU` to force execution at boot, logon, application launch, or user interaction, with several techniques requiring administrator privileges while others worked in the current user context. The examples included replacing `.txt` open commands, setting `HKCU\Environment\UserInitMprLogonScript`, creating malicious `InprocServer32` registrations for COM objects, altering `UninstallString` values for installed software, redirecting Event Viewer online help to a local executable, and using either Image File Execution Options or symbolic links to hijack `sethc.exe`. The posts also tied several methods to known threat activity, citing groups and malware such as **APT28**, **APT39**, **Turla**, **Kimsuky**, **APT3**, **APT29**, **APT32**, **APT38**, **APT41**, Ramsay, Attor, Zebrocy, Mosquito, and SILENTTRINITY as examples of similar persistence tradecraft seen in the wild.
Aug 14, 2026
Researchers detailed a series of local privilege-escalation attacks against antivirus and EDR products that abused **COM hijacking** to load attacker-controlled DLLs into trusted front-end processes and then pivot into privileged back-end services. The work showed a recurring design weakness: low-privileged user-facing components were allowed to issue powerful requests to `SYSTEM` services over named pipes or RPC without sufficient validation. In one generalized attack pattern, modified backend messages were used to write attacker-controlled registry values and alter application paths so that a privileged security process later launched code from a user-writable location, yielding `SYSTEM` access. Product-specific cases expanded that pattern across multiple vendors. **AVG Internet Security** (`CVE-2024-6510`) was exploited by combining COM hijacking, RPC abuse, self-defense disabling, and a TOCTOU race to swap in a malicious DLL for execution as `SYSTEM`; **Webroot Endpoint Protect** (`CVE-2023-7241`) exposed a file-deletion primitive over `\\.\pipe\WRSVCPipe` that was chained into DLL hijacking for a `SYSTEM` shell; **Check Point Harmony** (`CVE-2024-24912`) allowed a privileged service to download a DLL to an attacker-chosen path for lock-screen DLL hijacking; and **Bitdefender Total Security** (`CVE-2023-6154`) let a privileged backend write arbitrary registry values, enabling service `ImagePath` hijacking. The findings echo earlier research on brittle hardening controls in products such as **VirtualBox**, where COM registration abuse and DLL-loading edge cases also undermined process protections.
Jul 24, 2026