TrickBot injectDLL Module: Man-in-the-Browser Web Injection Against Certificate Transparency

Key facts for TrickBot injectDLL module

Detection coverage for TrickBot injectDLL module

As of 2026-08-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2133 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TrickBot injectDLL Reflective Browser Injection + Loopback SOCKS Proxy (SPL)

Detects reflective DLL injection (CreateRemoteThread / cross-process access) into Internet Explorer, Firefox, Chrome, or Edge (excluding Tor Browser's firefox.exe) combined with a locally-bound SOCKS4/SOCKS5 proxy handshake on TCP/15733 — the establishment signature of TrickBot's injectDLL man-in-the-browser module, which hooks Connect/ConnectEx/WSAIoctl and CertGetCertificateChain/CertVerifyCertificateChainPolicy to hijack and decrypt browser traffic.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1055.001, T1185, T1056.004
• Data sources: sysmon, windows_security, edr_process_events, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=8 OR EventCode=3)
| eval proc=lower(coalesce(TargetImage, Image))
| eval src=lower(SourceImage)
| eval is_remote_thread=if(EventCode=8 AND match(proc, "(iexplore|firefox|chrome|msedge)\.exe$") AND NOT match(src, "tor"), 1, 0)
| eval is_loopback_proxy=if(EventCode=3 AND DestinationIp="127.0.0.1" AND DestinationPort=15733 AND match(proc, "(iexplore|firefox|chrome|msedge)\.exe$"), 1, 0)
| where is_remote_thread=1 OR is_loopback_proxy=1
| eval technique=if(is_remote_thread=1, "T1055.001,T1185", "T1056.004")
| stats earliest(_time) as first_seen, latest(_time) as last_seen, count, values(technique) as techniques by ComputerName, User, proc, src, DestinationIp, DestinationPort
| where count > 0

Microsoft KQL

let BrowserProcs = dynamic(["iexplore.exe","firefox.exe","chrome.exe","msedge.exe"]);
DeviceEvents
| where Timestamp > ago(24h)
| where ActionType in ("CreateRemoteThreadApiCall","ProcessAccess","ReflectiveDllLoad")
| where (InitiatingProcessFileName has_any (BrowserProcs) or FileName has_any (BrowserProcs))
| where InitiatingProcessFolderPath !has "Tor Browser"
| project Timestamp, DeviceName, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, AccountName
| union (
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemoteIP == "127.0.0.1" and RemotePort == 15733
    | where InitiatingProcessFileName has_any (BrowserProcs)
    | project Timestamp, DeviceName, ActionType="LoopbackSocksProxyConnection", InitiatingProcessFileName, InitiatingProcessCommandLine, FileName=InitiatingProcessFileName, AccountName=InitiatingProcessAccountName
)

Sigma

title: TrickBot injectDLL Reflective Browser Injection
id: e3a1b2c4-1234-4a1b-9c3d-000000000001
status: experimental
description: Detects reflective DLL / remote-thread injection into Internet Explorer, Firefox, Chrome, or Edge, consistent with TrickBot injectDLL establishing a man-in-the-browser position. Corroborate with a loopback SOCKS proxy connection on TCP/15733 from the same process for higher fidelity.
references:
    - https://www.kryptoslogic.com/blog/2022/01/deep-dive-into-trickbots-web-injection/
    - https://attack.mitre.org/software/S0266/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-24
tags:
    - attack.defense-evasion
    - attack.collection
    - attack.credential-access
    - attack.t1055.001
    - attack.t1185
    - attack.t1056.004
    - attack.tool.trickbot
logsource:
    category: process_access
    product: windows
detection:
    selection_inject:
        TargetImage|endswith:
            - '\iexplore.exe'
            - '\firefox.exe'
            - '\chrome.exe'
            - '\msedge.exe'
    filter_tor:
        SourceImage|contains: 'Tor Browser'
    condition: selection_inject and not filter_tor
falsepositives:
    - EDR/AV agents or accessibility software performing legitimate process introspection into browser processes
    - Enterprise browser automation/testing frameworks (e.g. Selenium WebDriver extensions) that inject into browser processes
level: high

Known false positives:

• EDR/AV agents or accessibility software performing legitimate process introspection/injection into browser processes
• Enterprise browser automation/testing frameworks (e.g. Selenium WebDriver extensions) that inject into browser processes

Tuning notes: Baseline legitimate injectors (EDR agents, accessibility tools, enterprise browser extensions) by SourceImage hash/signer and suppress known-good signed binaries; narrow the loopback-proxy correlation to unsigned or unknown parent processes if the standalone injection alert is noisy.

• 🔒 TrickBot injectDLL Reflective Browser Injection + Loopback SOCKS Proxy (KQL) · unlock with TL Creds
• 🔒 TrickBot injectDLL HTTP/2 Downgrade, Root Certificate Staging & Registry Tampering (KQL) · unlock with TL Creds
• 🔒 TrickBot injectDLL Web-Inject C2 Beaconing and DPOST Credential Exfiltration (KQL) · unlock with TL Creds
• 🔒 TrickBot injectDLL Reflective Browser Injection + Loopback SOCKS Proxy (Sigma) · unlock with TL Creds
• 🔒 TrickBot injectDLL HTTP/2 Downgrade, Root Certificate Staging & Registry Tampering (Sigma) · unlock with TL Creds
• 🔒 TrickBot injectDLL Web-Inject C2 Beaconing and DPOST Credential Exfiltration (Sigma) · unlock with TL Creds
• 🔒 TrickBot injectDLL HTTP/2 Downgrade, Root Certificate Staging & Registry Tampering (SPL) · unlock with TL Creds
• 🔒 TrickBot injectDLL Web-Inject C2 Beaconing and DPOST Credential Exfiltration (SPL) · unlock with TL Creds

Indicators of compromise for TrickBot injectDLL module

As of 2026-08-24, Threadlinqs Intelligence tracks 22 indicators of compromise for TL-2026-2133.

Sample indicators (3 of 22)

• IP address: 175.184.232[.]234
• Domain: s1[.]deadseaproductions[.]com
• File hash: 6a75c212b49093517e6c29dcb2644df57a931194cf5cbd58e39e649c4a2b84ba

Defanged, TLP:CLEAR. Full set of 22 indicators: unlock with TL Creds.

How TrickBot injectDLL module works

TrickBot's injectDLL module performs reflective DLL injection into Internet Explorer, Firefox, Chrome, and Microsoft Edge (excluding Tor Browser's firefox.exe process) to establish a man-in-the-browser (MITB) position. Once injected, the module hooks Connect, ConnectEx, and WSAIoctl to silently redirect all outbound browser traffic through a locally bound SOCKS4/SOCKS5 proxy on 127.0.0.1:15733, and hooks CertGetCertificateChain and CertVerifyCertificateChainPolicy to strip TLS validation errors so a self-signed, malware-generated certificate (CN=localhost, sha256WithRSAEncryption, 10-year validity) is silently trusted. To specifically defeat Certificate Transparency and HTTP Public Key Pinning, the module rewrites the Expect-CT header to X-pect-XX and Public-Key-Pins / Public-Key-Pins-Report-Only to X-blic-Key-Pins variants before they reach the browser's security stack. Because HTTP/2 and SPDY complicate stream-level interception, the module disables both: for Internet Explorer via the EnableHTTP2 and TabProcGrowth registry values, for Firefox via pref.js overrides (browser.tabs.remote.autostart, network.http.spdy.enabled.http2), and for Chrome by terminating and relaunching the browser with --disable-http2 --use-spdy=off --disable-quic. For Chrome specifically, the module also rewrites the NotBefore timestamp on its spoofed certificate (resetting years after 2017 and months after September) to predate Chrome's Certificate Transparency enforcement cutoff, defeating CT checks at the certificate-issuance-date level rather than only the header level. Firefox injection additionally overwrites the BaseThreadInitThunk address before injecting to evade Firefox's own remote-thread detection. Once the browser trusts the proxy's TLS termination, TrickBot delivers a first-stage JavaScript loader that beacons to s1.deadseaproductions.com/api.js (identifying itself via X-Client-Id/X-Client-Origin headers containing the bot ID), which in turn pulls a second, page-specific web-inject only when the victim browses a targeted site — corroborated by Check Point Research, which found the module actively targeting customers of roughly 60 high-profile US banking, cryptocurrency, e-commerce, and technology brands (including major banks, Blockchain.com, Amazon, and large brokerages). Second-stage scripts, disguised with filenames like jquery-3.5.1.min.js, are served from myca.adprimblox.fun and seq.mediaimg23.monster, are XOR-encrypted, and include anti-analysis logic that crashes the tab process if it detects deobfuscation tooling. Captured credentials and form submissions are exfiltrated over a separate DPOST channel (https://<c2>:<port>/<gtag>/<botid>/<command>/) to a large rotating pool of HTTPS C2 servers. TrickBot itself is a modular, Malware-as-a-Service banking trojan first observed in 2016 as a believed derivative of Dyre; it is primarily operated by the Russia-based Wizard Spider group (aka UNC1878, GOLD BLACKBURN, TEMP.MixMaster), which has historically used TrickBot-compromised networks as an initial-access foothold for deploying Ryuk and Conti ransomware.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1055.001 Process Injection: Dynamic-link Library Injection; T1140 Deobfuscate/Decode Files or Information

Credential Access

T1056.004 Input Capture: Credential API Hooking

Command and Control

T1071.001 Application Layer Protocol: Web Protocols

defense-impairment

T1112 Modify Registry; T1553.004 Subvert Trust Controls: Install Root Certificate; T1685 Disable or Modify Tools

Collection

T1185 Browser Session Hijacking

Remediation for TrickBot injectDLL module

Immediate actions

• Block outbound DNS/network access to known injectDLL C2 domains (s1.deadseaproductions.com, myca.adprimblox.fun, seq.mediaimg23.monster, akama.pocanomics.com) and the associated DPOST C2 IP set at the perimeter
• Alert on unexpected local listeners or SOCKS4/SOCKS5 handshakes on TCP/15733 and other loopback proxy ports on endpoint hosts
• Hunt for the EnableHTTP2 / TabProcGrowth registry modifications and Chrome relaunches with --disable-http2 --use-spdy=off --disable-quic as man-in-the-browser indicators

Workarounds

• Enforce browser launch-flag and configuration integrity via GPO/MDM so HTTP/2, SPDY, and QUIC cannot be silently disabled by a relaunching process
• Deploy application allowlisting/attack-surface-reduction rules to block unauthorized code injection into browser processes (iexplore.exe, firefox.exe, chrome.exe, msedge.exe)

Longer-term hardening

• Deploy EDR with remote-thread and reflective-DLL injection detection (CreateRemoteThread, NtMapViewOfSection, manual PE mapping) scoped to browser processes
• Enforce Certificate Transparency and pinning validation at a network-level TLS inspection/proxy layer that is independent of the endpoint browser's own header-based checks, so a compromised endpoint cannot silently strip Expect-CT/HPKP
• Maintain security-awareness training against macro-enabled phishing attachments and malicious links, TrickBot's primary initial-access vector

Affected and fixed versions

• Microsoft — Internet Explorer
  Vulnerable versions: all installed versions targeted by injectDLL reflective injection
• Mozilla — Firefox
  Vulnerable versions: desktop releases targeted by injectDLL reflective injection
• Google — Chrome
  Vulnerable versions: desktop releases targeted by injectDLL reflective injection
• Microsoft — Edge
  Vulnerable versions: Chromium-based desktop releases targeted by injectDLL reflective injection

Timeline of TrickBot injectDLL module

• 2016-01-01 locked-ioc-20 first identified in the wild as a banking trojan, believed to be a derivative of the earlier Dyre malware.
• 2017-01-01 locked-ioc-20 adds worm-propagation capability and an Outlook credential-harvesting module, beginning its shift into a modular MaaS platform.
• 2018-12-01 locked-ioc-20 is recognized as one of the top cybersecurity threats in the market as its module ecosystem and ransomware-delivery role expand.
• 2022-01-24 Kryptos Logic publishes a technical deep dive on the locked-ioc-19 module, detailing the localhost proxy, API hooking, and Certificate Transparency/HPKP header-tampering technique.
• 2022-02-16 Check Point Research publishes 'A Modern Ninja,' independently documenting locked-ioc-19 web-inject targeting of customers of roughly 60 high-profile US banking, cryptocurrency, e-commerce, and technology brands.
• 2026-08-24 Threadlinqs threat-intel pipeline ingests and documents the locked-ioc-19 man-in-the-browser technique for detection engineering coverage.

Sources cited for TrickBot injectDLL module

• Deep Dive into TrickBot's Web Injection kryptoslogic.com · Research · 2022-01-24
• A Modern Ninja: Evasive Trickbot Attacks Customers of 60 High-Profile Companies Check Point Research · Research · 2022-02-16
• TrickBot, Software S0266 MITRE · Research · 2026-08-24
• TrickBot (Malware Family) malpedia.caad.fkie.fraunhofer.de · Research · 2026-08-24
• What is TrickBot Malware? CrowdStrike · Vendor report · 2026-08-24
• Wizard Spider en.wikipedia.org · News · 2026-08-24

Threats related to TrickBot injectDLL module

• JSCeal Cryptocurrency Stealer: Check Point Details Static Deobfuscation of Compiled V8 Bytecode Payloads

More from Periwinkle Tempest

• DIAVOL Ransomware – Reverse Engineering Analysis (Wizard Spider-linked, .lock64)
• Ryuk Ransomware Attacks via Emotet and Trickbot Chain; North Korean (Lazarus) Attribution Questioned
• TrickBot Banking Trojan (Anchor_DNS) Uses DNS Tunneling Over westurn.in for Covert C2
• TrickBot Malware Variant Adopts DNS Tunneling for C2 Communications (westurn.in)
• SystemBC (Coroxy / DroxiDat) Malware: Multi-Purpose SOCKS5/Tor Proxy Backdoor Enabling Ransomware Operations
• Armenian National Karen Vardanyan Pleads Guilty to Ryuk Ransomware Conspiracy (District of Oregon)

Previous and next in malware

• Fake GTA 6 'Extended Look' and Demo Sites Deliver Vidar Infostealer Previous report
• CrossC2 Cross-Platform Cobalt Strike Loader Deployed with ReadNimeLoader in Attacks Linked to BlackBasta Infrastructure Next report