Threat reportMalwareTL-2026-3826
TrickBot injectDLL Web Injection Module: Certificate Transparency Bypass, Localhost Proxy and Multistage JavaScript Injection
TrickBot injectDLL Web Injection Module (TL-2026-3826), also tracked as TrickBot injectDLL, is a high-severity malware campaign, first published 2026-10-17. It has no confirmed attribution, affects Microsoft Internet Explorer / Edge on Windows, maps to 13 MITRE ATT&CK techniques (T1003.001, T1027, T1053.005), and is covered by 9 detection rules and 36 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 13MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 36Indicators of compromise
Key facts for TL-2026-3826
- Threat ID
- TL-2026-3826
- Also known as
- TrickBot injectDLL, TrickBot winj webinject, injectDll32, injectDll64
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, technology, cryptocurrency, ecommerce
- Target regions
- North America
- Detection rules
- 9
- Indicators of compromise
- 36
Malware and tooling in TrickBot injectDLL Web Injection Module
Malware and tooling: Trick Bot
How TrickBot injectDLL Web Injection Module works
Kryptos Logic analyzes TrickBot's injectDLL web injection module, which runs a localhost proxy on 127.0.0.1:15733 to intercept browser TLS traffic, re-signs website certificates with a malicious CA and strips Expect-CT and Public-Key-Pins headers. It injects multistage JavaScript (winj config format) into Internet Explorer, Firefox, Chrome and Edge, and exfiltrates captured data to DPOST C2 servers.
TrickBot's injectDLL module (injectDll32/injectDll64) is the malware's man-in-the-browser web injection component. It replaced the older sinj (static inject) and dinj (dynamic inject) config types with a single winj config containing Zeus-style webinjects. The debug build referred to this config as 'zeus'. Kryptos Logic first documented the Zeus-style injectDLL in July 2021 and published a deep dive on the module on 2022-01-24, reflecting activity through late 2021.
The module exports two functions. Start handles process setup and launches threads, and Control parses the configuration files (winj, dpost). The network-facing threads are Proxy, Session, DPOST and ZeusPing. Injection works by reflectively injecting a DLL into the browser processes (Internet Explorer, Firefox, Chrome and Edge). Browser traffic is then redirected through a local proxy listening on 127.0.0.1:15733. Kryptos Logic describes it as a SOCKS proxy. If traffic matches a configured target URL, responses are modified according to the winj rules: set_url selects targets, data_before and data_after define injection points, and depend names a C2 URL used for dependency checks.
To make the interception invisible, the Session thread creates self-signed localhost certificates for the proxy-to-website connection. It duplicates each website certificate, re-signs it with a malicious CA, and adds the 'TLS Web Server Authentication' extension. It also neuters certificate transparency and key-pinning protections. The response headers 'Expect-CT' and 'Public-Key-Pins' are rewritten to the inert strings 'X-pect-XX' and 'X-blic-Key-Pins'. For Chrome targets, the certificate NotBefore timestamp is altered when the year is above 2017, resetting October or later to September, to get past Chrome's Certificate Transparency enforcement. The injected browser module hooks Connect/ConnectEx for the proxy handshake. It hooks CertGetCertificateChain and CertVerifyCertificateChainPolicy to remove trust validation errors.
Browser-specific handling: Firefox gets a BaseThreadInitThunk address overwrite to bypass thread detection, and its CA certificates are replaced via nss3.dll APIs. Chrome is restarted with --disable-http2 --use-spdy=off --disable-quic. Internet Explorer has the EnableHTTP2 registry value disabled and TabProcGrowth set to force single-process tabs. HTTP/2, SPDY and QUIC are disabled so traffic stays proxyable HTTP/1.x.
The injected JavaScript is delivered in stages. The core script beacons to s1.deadseaproductions.com with the headers X-Client-Id: %BOTID% and X-Client-Origin. Secondary scripts fetch the final jquery-3.5.1.min.js payload from further C2 domains (myca.adprimblox.fun, seq.mediaimg23.monster, akama.pocanomics.com). Check Point Research (2022-02-16) reports the payload targets customers of 60 high-profile financial and technology companies, steals credentials from banking portals and cryptocurrency exchanges through form interception and keystroke logging, and uses anti-analysis tricks. Those tricks are a comparison of a JavaScript function's string representation against a hardcoded regular expression (the browser tab crashes if it fails) and a C2 that requires a valid Referer header. Second-stage URLs are built from %BOTID% and decoded constants and end in '_6vpixf7ug8h5sli7gqwj/jquery-3.5.1.min.js'. The DPOST thread sends captured data to 25 C2 IPs listed in the dpost config (port 443). ZeusPing contacts the C2s listed in winj.
Attribution to a specific actor is not stated in the sources, and no CVE is involved. SentinelOne's earlier analysis (2019 sample) also documents TrickBot persistence via a scheduled task named SpeedNetworkTask, copies to a hidden roaming-profile directory, and harvesting of the IE IntelliForms storage registry key. Because the source article is dated 2022-01-24, recency should be verified before downstream use.
MITRE ATT&CK techniques used in TL-2026-3826
Credential Access
T1003.001 OS Credential Dumping: LSASS Memory; T1555.003 Credentials from Web Browsers; T1557 Adversary-in-the-Middle
Defense Evasion
T1027 Obfuscated Files or Information; T1055.001 Process Injection: Dynamic-link Library Injection; T1620 Reflective Code Loading
Persistence
T1053.005 Scheduled Task/Job: Scheduled Task
Collection
T1056 Input Capture; T1185 Browser Session Hijacking
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1090.001 Proxy: Internal Proxy
defense-impairment
T1112 Modify Registry; T1553.004 Subvert Trust Controls: Install Root Certificate
Affected products and versions in TrickBot injectDLL Web Injection Module
Remediation for TrickBot injectDLL Web Injection Module
Immediate actions
- Block the listed C2 domains and DPOST C2 IPs (TCP/443) at the perimeter and DNS layer
- Hunt endpoints for browser processes connecting to 127.0.0.1:15733
- Hunt for Chrome launched with --disable-http2 --use-spdy=off --disable-quic outside of administrative use
- Isolate hosts where browsers show certificates issued by an unexpected CA and reset credentials used in browsers on those hosts
Workarounds
- Alert on TLS certificates presented to browsers that lack expected CT SCTs or that are signed by non-public CAs
- Egress-filter outbound HTTPS to uncategorized or newly registered domains such as the .fun and .monster TLDs used here
Longer-term hardening
- Deploy EDR with detection for reflective DLL injection into browser processes
- Monitor for unauthorized root CA additions in Windows and Firefox certificate stores
- Use phishing-resistant MFA for banking and cryptocurrency portals to limit the value of stolen credentials
- Restrict browser command-line and registry modification (EnableHTTP2, TabProcGrowth)
Timeline of TrickBot injectDLL Web Injection Module
- TrickBot sample delivered via malicious Excel attachment is analyzed by SentinelOne; documents webinject credential theft, IE IntelliForms harvesting, the injectDll64.dll module and SpeedNetworkTask persistence
- Approximate date (source says only 'October 2020'): TrickBot infrastructure takedown; Check Point reports the pre-October 2020 sinj/dinj web-inject configs were later superseded by a winj config sourced from the C2, and 140,000+ victims were counted after the takedown
- Kryptos Logic documents that the injectDll debug builds called the Zeus-style config 'zeus' while the released injectDll32/injectDll64 modules renamed it 'winj', delivered through module requests of the form https://<c2>/<gtag>/<botid>/5/injectDll64/
- Kryptos Logic publishes 'TrickBot and Zeus', documenting the Zeus-style injectDll32/injectDll64 modules, the winj config and the local SOCKS proxy
- Kryptos Logic publishes 'Deep Dive into Trickbot's Web Injection' detailing the certificate transparency bypass, localhost proxy, four-browser injection and DPOST C2 infrastructure
- Check Point Research publishes analysis of TrickBot's injectDLL targeting customers of 60 high-profile financial and technology companies, with anti-analysis details (function-string regex check, Referer-header requirement, blocking of researcher IPs) and reporting of more than 140,000 infected victims after the October 2020 takedown
Sources cited for TrickBot injectDLL Web Injection Module
Detection coverage for TL-2026-3826
As of 2026-10-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3826 across Splunk SPL, Microsoft KQL and Sigma, covering 36 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.