Hackers Can Inject Malicious Code into Antivirus to Create a Backdoor

Executive summary

A recently disclosed technique demonstrates how attackers can inject malicious code into antivirus (AV) processes to create a stealthy backdoor. By cloning AV services, hijacking Windows cryptographic provider settings, and loading a signed malicious DLL into a protected AV process, an adversary can run code with high privileges inside a trusted process severely complicating detection and removal. The technique is currently demonstrated as a proof-of-concept, but the implications are high: if weaponized, attackers could turn endpoint protection into a persistent, stealthy foothold.

🧠 Overview

What if the very software that’s meant to protect your computer becomes the reason it gets hacked?
That’s exactly what security researchers have discovered — a shocking new method that lets attackers inject malicious code directly into antivirus programs, turning them into powerful backdoors for full system control.

This new attack shows that even antivirus software isn’t untouchable — and when it’s compromised, the impact can be devastating.

🔍 What Happened?

A security researcher recently revealed a way to insert malicious code inside antivirus processes like Bitdefender, Avast, or Trend Micro.
Instead of trying to disable or bypass the antivirus, hackers can now make it work for them.

The trick uses a combination of Windows registry manipulation, service cloning, and fake digital certificates to make the antivirus load a malicious file — all while believing it’s legitimate.

Here’s how it works step by step:

Clone the antivirus service — The attacker duplicates a protected AV service (for example, Bitdefender’s BDProtSrv) by copying its settings from the registry.
Hijack the cryptography provider — They change a Windows registry key (like HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider) to point to a malicious DLL file.
Fake a digital signature — The hacker signs that DLL with a cloned or stolen certificate, making it look trustworthy.
Inject into the antivirus process — The AV process (or its clone) loads the malicious DLL during startup, thinking it’s safe.
Hide the evidence — After the code is injected, the attacker resets the registry back to normal to avoid suspicion.

Once the malicious code runs inside the antivirus process, it gains high privileges (SYSTEM level), allowing it to do almost anything — install backdoors, steal data, disable defenses, or spread across the network — all while staying invisible.

💡 Why This Matters

Antivirus software runs with the highest level of privilege on your system. That means any code inside those processes can access protected files, install drivers, or modify system components.
If attackers take over an antivirus, they essentially own the system.

What makes this worse?

The malicious code is running inside a trusted process.
Security tools often ignore AV processes to avoid false alarms.
Even experienced analysts might miss it during an investigation.

In short: this attack turns your protector into the attacker.

🧩 Tools Used in the

Research

The proof-of-concept was created using a tool called “IAmAntimalware”, shared by a researcher known as Two Seven One Three on X (formerly Twitter).

This tool automates the entire process:

Cloning antivirus services
Modifying registry keys
Loading malicious DLLs
Faking certificates

Although it was released for research and awareness, such tools often become templates for real-world cybercriminals.

🧠 Analysis & Technical Insight

This attack doesn’t rely on an antivirus vulnerability — it abuses trust and privilege design flaws.
Antivirus products protect their own processes from tampering (using self-defense mechanisms). However, if a cloned or injected process looks legitimate enough, those same protections can shield the attacker’s code.

Once the malicious code runs:

It inherits antivirus privileges (SYSTEM).
It can write to restricted folders and registry areas.
It can create or modify files without triggering alerts.
It becomes nearly invisible to standard EDR or AV detection.

Essentially, the attacker is hiding inside the bodyguard’s armor.

🚨 Indicators of Compromise (IOCs)

While the report didn’t provide specific file hashes, these are warning signs you should look out for:

Duplicate or suspicious antivirus services (like BDProtSrv_clone or avsvc_copy).

Registry changes under:

HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider

Antivirus processes loading DLLs from unusual folders (like %TEMP% or user directories).
Unrecognized files in antivirus installation folders (for example, a random mark.txt file).
Signed files with unexpected digital certificates.
Antivirus making strange outbound connections or network activity.

🛡️ How to Protect Yourself

Here’s what organizations and security teams can do to defend against this technique:

Monitor for duplicate services — Watch for any new services that mimic antivirus names.
Audit critical registry keys — Especially the cryptography provider and COM object paths.
Check module loads — Ensure your AV processes only load official DLLs.
Verify code signatures — Look for fake or cloned certificates on loaded modules.
Enable file integrity monitoring — Track unexpected changes in AV installation directories.
Use defense in depth — Combine antivirus with EDR, privilege management, and behavioral monitoring.
Coordinate with your antivirus vendor — Ensure they can detect unauthorized module loads and registry tampering.

🕵️ Who’s Behind It?

The technique was shared for educational and research purposes — no active hacker group has been officially linked to using it yet.

However, this kind of stealth and privilege abuse is something advanced persistent threat (APT) groups or state-backed hackers could easily adopt.

Cybercriminals love ready-made tools — and since the concept is public, it’s only a matter of time before someone turns it into a real attack.

🔐 Final Thoughts

This discovery reminds us of a painful truth in cybersecurity: no software is immune, not even the ones designed to protect you.
By turning antivirus software into a weapon, attackers can hide in plain sight — right under the nose of your defenses.

The takeaway?
Don’t blindly trust your protection tools.
Monitor them, validate them, and make sure they’re not secretly working against you.

Search This Blog

Cyber Creatures