TrickBot injectDLL Module: Man-in-the-Browser Web Injection Against Certificate Transparency — Threadlinqs Intelligence
As of 2026-08-24, TrickBot injectDLL Module: Man-in-the-Browser Web Injection Against Certificate Transparency is a high-severity malware threat attributed to Periwinkle Tempest (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 22 indicators of compromise.
Threat ID: TL-2026-2133 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Periwinkle Tempest · Russia · FINANCIAL
Kryptos Logic's technical analysis of TrickBot's injectDLL module documents a man-in-the-browser technique: the trojan opens a localhost SOCKS proxy on 127.0.0.1:15733, hooks browser networking and
TrickBot's injectDLL module performs reflective DLL injection into Internet Explorer, Firefox, Chrome, and Microsoft Edge (excluding Tor Browser's firefox.exe process) to establish a man-in-the-browser (MITB) position. Once injected, the module hooks Connect, ConnectEx, and WSAIoctl to silently redirect all outbound browser traffic through a locally bound SOCKS4/SOCKS5 proxy on 127.0.0.1:15733, and hooks CertGetCertificateChain and CertVerifyCertificateChainPolicy to strip TLS validation errors so a self-signed, malware-generated certificate (CN=localhost, sha256WithRSAEncryption, 10-year validity) is silently trusted. To specifically defeat Certificate Transparency and HTTP Public Key Pinning, the module rewrites the Expect-CT header to X-pect-XX and Public-Key-Pins / Public-Key-Pins-Report-Only to X-blic-Key-Pins variants before they reach the browser's security stack. Because HTTP/2 and SPDY complicate stream-level interception, the module disables both: for Internet Explorer via the EnableHTTP2 and TabProcGrowth registry values, for Firefox via pref.js overrides (browser.tabs.remote.autostart, network.http.spdy.enabled.http2), and for Chrome by terminating and relaunching the browser with --disable-http2 --use-spdy=off --disable-quic. For Chrome specifically, the module also rewrites the NotBefore timestamp on its spoofed certificate (resetting years after 2017 and months after September) to predate Chrome's Certificate Transparency enforcement cutoff, defeating CT checks at the certificate-issuance-date level rather than only the header level. Firefox injection additionally overwrites the BaseThreadInitThunk address before injecting to evade Firefox's own remote-thread detection. Once the browser trusts the proxy's TLS termination, TrickBot delivers a first-stage JavaScript loader that beacons to s1.deadseaproductions.com/api.js (identifying itself via X-Client-Id/X-Client-Origin headers containing the bot ID), which in turn pulls a second, page-specific web-inject only when the victim browses a targeted site — corroborated by Check Point Research, which found the module actively targeting customers of roughly 60 high-profile US banking, cryptocurrency, e-commerce, and technology brands (including major banks, Blockchain.com, Amazon, and large brokerages). Second-stage scripts, disguised with filenames like jquery-3.5.1.min.js, are served from myca.adprimblox.fun and seq.mediaimg23.monster, are XOR-encrypted, and include anti-analysis logic that crashes the tab process if it detects deobfuscation tooling. Captured credentials and form submissions are exfiltrated over a separate DPOST channel (https://<c2>:<port>/<gtag>/<botid>/<command>/) to a large rotating pool of HTTPS C2 servers. TrickBot itself is a modular, Malware-as-a-Service banking trojan first observed in 2016 as a believed derivative of Dyre; it is primarily operated by the Russia-based Wizard Spider group (aka UNC1878, GOLD BLACKBURN, TEMP.MixMaster), which has historically used TrickBot-compromised networks as an initial-access foothold for deploying Ryuk and Conti ransomware.
Target sectors: banking, finance, cryptocurrency, ecommerce, technology, investment-services
Target regions: North America, united states of america, Global
Timeline
- TrickBot first identified in the wild as a banking trojan, believed to be a derivative of the earlier Dyre malware.
- TrickBot adds worm-propagation capability and an Outlook credential-harvesting module, beginning its shift into a modular MaaS platform.
- TrickBot is recognized as one of the top cybersecurity threats in the market as its module ecosystem and ransomware-delivery role expand.
- Kryptos Logic publishes a technical deep dive on the injectDLL module, detailing the localhost proxy, API hooking, and Certificate Transparency/HPKP header-tampering technique.
- Check Point Research publishes 'A Modern Ninja,' independently documenting injectDLL web-inject targeting of customers of roughly 60 high-profile US banking, cryptocurrency, e-commerce, and technology brands.
- Threadlinqs threat-intel pipeline ingests and documents the injectDLL man-in-the-browser technique for detection engineering coverage.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 22 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1055.001, T1185, T1553.004, T1685, T1112, T1036, T1027, T1140, T1071.001, T1056.004
