🎯 Process hollowing

The items that name it 7

• NIK C2: The new AI-enabled command-and-control framework
  writeupas classification.key entities2026-10-29
• Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware
  writeupas classification.key entities2026-10-21
• DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer
  writeupas classification.key entities2026-09-22
• The Closed Quorum: Inside the First Reported Autonomous AI C2 Implant
  writeupas techniques2026-09-22It is written here as Process hollowing (PEB-walk).

  injectProcess() used when exploit_type is process_hollow

• Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware
  writeupas techniques2026-09-15

  MsBuild.exe hollowed and used to run malicious code, importing only kernel32, for both the rogue CA payload and the Ledger wallet implant

• ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager
  writeupas techniques2026-09-08

  NativeAOT loader starts explorer.exe suspended, manually maps PE headers/sections, redirects entry point, and resumes it to run ZigCryptoStealer

• Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware
  writeupas techniques2026-08-19

  Payloads two and three hollow the trusted Microsoft binary MsBuild.exe (C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MsBuild.exe) to run their code