🎯 Process injection

The items that name it 7

• Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Chrome/Windows Zero-Day Chain
  writeup2026-09-09It is written here as Process injection (shellcode/CreateProcess stub).

  Position-independent shellcode (pp) finds the browser's parent process, opens it with full access, allocates executable memory, writes a stub and command line, and starts a remote thread to call CreateProcessA, executing commands outside the renderer sandbox.

• Socket: Operation Muck and Load
  writeup2026-07-16

  WriteProcessMemory and SetThreadContext API usage observed supporting process injection.

• ZX41R/awesome-reverse-engineering-and-malware-analysis
  repo2026-07-06

  covered under malware development for study/lab purposes

• Socket: 5 Malicious NuGet Packages Target Chinese .NET Developers
  writeup2026-05-07It is written here as Process Injection: Process Doppelgänging.

  SharpInjector with architecture-matched injection into long-lived processes via PEB-walking manual module loading.

• Introducing MacNoise!
  tool2026-02-26It is written here as Process injection (proc_inject module).

  Injects a dylib into a target process (e.g. dylib_path into /usr/bin/true) to emulate malicious code injection

• A Idealistic View of Malware Analysis Definitions
  article2026-01-13

  A process opening another process to inject and run code; can be malicious or benign (DRM, copy protection, crash reporting, telemetry, hot-patching)

• ClickFix Gets Creative: Malware Buried in Images
  writeup2025-11-24

  Shellcode injected into explorer.exe using VirtualAllocEx, CreateProcessA (suspended), WriteProcessMemory, CreateRemoteThread, WaitForSingleObject, TerminateProcess, CloseHandle