# TrickBot injectDLL Web Injection Module: Certificate Transparency Bypass, Localhost Proxy and Multistage JavaScript Injection

> Kryptos Logic analyzes TrickBot's injectDLL web injection module, which runs a localhost proxy on 127.0.0.1:15733 to intercept browser TLS traffic, re-signs website certificates with a malicious CA and strips Expect-CT and Public-Key-Pins headers. It injects multistage JavaScript (winj config format) into Internet Explorer, Firefox, Chrome and Edge, and exfiltrates captured data to DPOST C2 servers.

- **Published:** 2026-10-17T17:25:06Z
- **Last reviewed:** 2026-10-17T17:25:06Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3826
- **ID:** TL-2026-3826
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 36 (full data via the Threadlinqs MCP server — Purple tier)

## Description

TrickBot's injectDLL module (injectDll32/injectDll64) is the malware's man-in-the-browser web injection component. It replaced the older sinj (static inject) and dinj (dynamic inject) config types with a single winj config containing Zeus-style webinjects. The debug build referred to this config as 'zeus'. Kryptos Logic first documented the Zeus-style injectDLL in July 2021 and published a deep dive on the module on 2022-01-24, reflecting activity through late 2021.

The module exports two functions. Start handles process setup and launches threads, and Control parses the configuration files (winj, dpost). The network-facing threads are Proxy, Session, DPOST and ZeusPing. Injection works by reflectively injecting a DLL into the browser processes (Internet Explorer, Firefox, Chrome and Edge). Browser traffic is then redirected through a local proxy listening on 127.0.0.1:15733. Kryptos Logic describes it as a SOCKS proxy. If traffic matches a configured target URL, responses are modified according to the winj rules: set_url selects targets, data_before and data_after define injection points, and depend names a C2 URL used for dependency checks.

To make the interception invisible, the Session thread creates self-signed localhost certificates for the proxy-to-website connection. It duplicates each website certificate, re-signs it with a malicious CA, and adds the 'TLS Web Server Authentication' extension. It also neuters certificate transparency and key-pinning protections. The response headers 'Expect-CT' and 'Public-Key-Pins' are rewritten to the inert strings 'X-pect-XX' and 'X-blic-Key-Pins'. For Chrome targets, the certificate NotBefore timestamp is altered when the year is above 2017, resetting October or later to September, to get past Chrome's Certificate Transparency enforcement. The injected browser module hooks Connect/ConnectEx for the proxy handshake. It hooks CertGetCertificateChain and CertVerifyCertificateChainPolicy to remove trust validation errors.

Browser-specific handling: Firefox gets a BaseThreadInitThunk address overwrite to bypass thread detection, and its CA certificates are replaced via nss3.dll APIs. Chrome is restarted with --disable-http2 --use-spdy=off --disable-quic. Internet Explorer has the EnableHTTP2 registry value disabled and TabProcGrowth set to force single-process tabs. HTTP/2, SPDY and QUIC are disabled so traffic stays proxyable HTTP/1.x.

The injected JavaScript is delivered in stages. The core script beacons to s1.deadseaproductions.com with the headers X-Client-Id: %BOTID% and X-Client-Origin. Secondary scripts fetch the final jquery-3.5.1.min.js payload from further C2 domains (myca.adprimblox.fun, seq.mediaimg23.monster, akama.pocanomics.com). Check Point Research (2022-02-16) reports the payload targets customers of 60 high-profile financial and technology companies, steals credentials from banking portals and cryptocurrency exchanges through form interception and keystroke logging, and uses anti-analysis tricks. Those tricks are a comparison of a JavaScript function's string representation against a hardcoded regular expression (the browser tab crashes if it fails) and a C2 that requires a valid Referer header. Second-stage URLs are built from %BOTID% and decoded constants and end in '_6vpixf7ug8h5sli7gqwj/jquery-3.5.1.min.js'. The DPOST thread sends captured data to 25 C2 IPs listed in the dpost config (port 443). ZeusPing contacts the C2s listed in winj.

Attribution to a specific actor is not stated in the sources, and no CVE is involved. SentinelOne's earlier analysis (2019 sample) also documents TrickBot persistence via a scheduled task named SpeedNetworkTask, copies to a hidden roaming-profile directory, and harvesting of the IE IntelliForms storage registry key. Because the source article is dated 2022-01-24, recency should be verified before downstream use.

## MITRE ATT&CK

- T1185 Browser Session Hijacking
- T1557 Adversary-in-the-Middle
- T1056 Input Capture
- T1555.003 Credentials from Web Browsers
- T1055.001 Process Injection: Dynamic-link Library Injection
- T1620 Reflective Code Loading
- T1553.004 Subvert Trust Controls: Install Root Certificate
- T1112 Modify Registry
- T1027 Obfuscated Files or Information
- T1090.001 Proxy: Internal Proxy
- T1071.001 Application Layer Protocol: Web Protocols
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1003.001 OS Credential Dumping: LSASS Memory

## Sources

- [Deep Dive into Trickbot's Web Injection (Kryptos Logic)](https://www.kryptoslogic.com/blog/2022/01/deep-dive-into-trickbots-web-injection/)
- [TrickBot and Zeus (Kryptos Logic)](https://www.kryptoslogic.com/blog/2021/07/trickbot-and-zeus/)
- [A Modern Ninja: Evasive Trickbot Attacks Customers of 60 High-Profile Companies (Check Point Research)](https://research.checkpoint.com/2022/a-modern-ninja-evasive-trickbot-attacks-customers-of-60-high-profile-companies/)
- [TrickBot Technical Analysis (SentinelOne)](https://www.sentinelone.com/blog/trickbot-technical-analysis-banking-trojan-malware/)
- [Kryptos Logic Blog index](https://www.kryptoslogic.com/blog/index.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3826