Threat reportMalwareTL-2026-3838
TrickBot adds Zeus-style webinject configs (winj) to injectDll32/injectDll64 webinject module
TrickBot adds Zeus-style webinject configs (winj) to (TL-2026-3838), also tracked as TrickBot webinject module, is a high-severity malware campaign, first published 2026-10-17. It has no confirmed attribution, affects Microsoft Windows (32-bit and 64-bit endpoints running browsers, maps to 16 MITRE ATT&CK techniques (T1003.001, T1053.005, T1055.001), and is covered by 9 detection rules and 23 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 16MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 23Indicators of compromise
Key facts for TL-2026-3838
- Threat ID
- TL-2026-3838
- Also known as
- TrickBot webinject module, injectDll, winj webinject
- Severity
- HIGH
- Status
- MONITORING
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, retail, health, government administration
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 23
Malware and tooling in TrickBot adds Zeus-style webinject configs (winj) to
Malware and tooling: Conti, Emotet - S0367, IcedID, IcedID/Bokbot, Ryuk, TrickBot, Zeus, Trick Bot, Zeus
How TrickBot adds Zeus-style webinject configs (winj) to works
Kryptos Logic reports that TrickBot, a modular trojan active since 2016 that moved from bank fraud toward ransomware enablement, revived and updated its webinject module to support Zeus-style webinject configs. The module, deployed as injectDll32/injectDll64, replaces the sinj and dinj config files with a unified winj config and shares substantial code with IcedID/Bokbot's Man-in-the-Browser webinject module.
TrickBot is an established, widespread multi-purpose modular trojan observed since 2016, reusing code from the Dyre/Dyreza banking trojan that went offline in 2015. It began as a banking trojan and its operators later used it as an access broker for ransomware; the Center for Internet Security (MS-ISAC) observed from June 2019 an increasingly close relationship between initial TrickBot infections and Ryuk ransomware attacks, with Conti also named as a follow-on strain. Initial infection commonly arrives via malspam with macro-enabled Office documents that run a base64-obfuscated VBScript to download TrickBot, and Emotet frequently distributed TrickBot as a secondary payload. CIS also documents scheduled-task persistence, attempts to disable Windows Defender, SMB/LDAP lateral movement (TabDll with EternalRomance, CVE-2017-0147), Mimikatz-based LSASS credential scraping and browser cookie harvesting. U.S. Cyber Command and private-sector partners conducted takedown operations against TrickBot in fall 2020.
In June 2021 the Kryptos Logic Vantage Team observed new development of TrickBot's webinject capability, work that had previously been shelved for over a year. The updated module was pushed to real victims as injectDll32 (32-bit) and injectDll64 (64-bit), superseding the older webinject module. Previously, webinject configuration was split across two files: sinj (static injects) and dinj (dynamic injects). The new module uses a single config named winj written in Zeus-style syntax (set_url <target-url> GP, followed by data_before, data_end, data_after and data_inject blocks; a depend field supplies a C2 URL for GET requests). A separate dpost config defines handler C2s that receive the webinject results. Debug builds referred to the Zeus-style configs as 'zeus'. The module requests its configs from the C2 using the format https://<c2_address>/<gtag>/<unique_bot_id>/5/injectDll64/.
The module implements Man-in-the-Browser functionality. It proxies browser traffic through a local SOCKS server, hooks socket APIs to redirect connections, modifies traffic for URLs that match the config, and for HTTPS creates a self-signed TLS certificate that it adds to the certificate store. It also patches certificate validation functions (CertVerifyCertificateChainPolicy, CertGetCertificateChain) so the browser raises no warning. Kryptos Logic documented substantial code overlap with IcedID/Bokbot's Man-in-the-Browser webinject module; IcedID/Bokbot uses analogous sinXX/tinXX/winXX config naming. Debug builds of the 32-bit and 64-bit modules were also observed, and the analysis supplied a YARA string referencing the debug path c:\developer\webinject\http-lib\parser.c and the filename pattern wbi-x(86|64).dll.
A follow-up Kryptos Logic deep dive (analysis dated 2022-01-24) details the mechanics of the winj-era module: reflective DLL injection into Internet Explorer, Firefox, Chrome and Edge (skipping Tor Browser); overwriting BaseThreadInitThunk in Firefox before injecting to evade its remote-thread detection; restarting Chrome with --disable-http2, --disable-quic and --enable-logging; a local proxy bound to 127.0.0.1:15733 using a modified SOCKS4 handshake (browser type byte plus browser PID, reply 005a000000000000); hooks on Connect/ConnectEx, WSAIoctl, CertGetCertificateChain and CertVerifyCertificateChainPolicy; rewriting Expect-CT, Public-Key-Pins and Public-Key-Pins-Report-Only response headers so certificate-transparency and pinning checks are defeated; replacement of Firefox CA certificates via nss3.dll APIs; and a multistage JavaScript injection chain (stage 1 beacon to s1.deadseaproductions.com with X-Client-Id/X-Client-Origin headers, stage 2 from myca.adprimblox.fun, stage 3 jQuery payload from akama.pocanomics.com). dpost command 60 exfiltrates Base64-encoded POST data to https://<c2>:<port>/<gtag>/<botid>/60/.
The 2021 source article states no CVEs, IP addresses, domains or CVSS score; the domains above come from the 2022 follow-up. The severity is an analyst assignment and not stated in the source. This record is historical/background coverage of a TrickBot capability change. BeaconBeagle was queried for s1.deadseaproductions.com and returned no matching configs (empty result).
MITRE ATT&CK techniques used in TL-2026-3838
Credential Access
T1003.001 LSASS Memory; T1056.004 Credential API Hooking; T1539 Steal Web Session Cookie; T1557 Adversary-in-the-Middle
Persistence
Defense Evasion
T1055.001 Dynamic-link Library Injection; T1620 Reflective Code Loading
Execution
T1059.005 Visual Basic; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1090.001 Internal Proxy
defense-impairment
T1112 Modify Registry; T1553.004 Install Root Certificate; T1685 Disable or Modify Tools
Collection
T1185 Browser Session Hijacking
Initial Access
Affected products and versions in TrickBot adds Zeus-style webinject configs (winj) to
- Microsoft — Windows (32-bit and 64-bit endpoints running browsers targeted by the webinject module)
Vulnerable versions: Not version-specific; behavioral malware threat
Remediation for TrickBot adds Zeus-style webinject configs (winj) to
Immediate actions
- Hunt for injectDll32/injectDll64 modules and wbi-x86.dll / wbi-x64.dll artifacts and the published SHA256 hashes on endpoints
- Block and hunt for DNS/proxy traffic to s1.deadseaproductions.com, myca.adprimblox.fun and akama.pocanomics.com
- Isolate infected systems, then perform network-wide password resets after remediation and avoid using domain credentials on compromised machines
- Alert on new root certificates added to the Windows certificate store by non-administrative or unexpected processes
- Alert on browser processes loading unsigned DLLs, connecting to a local SOCKS listener on 127.0.0.1:15733, or being restarted with --disable-http2 --disable-quic --enable-logging
Workarounds
- Disable Office macros from the internet via policy
- Restrict who can modify the machine certificate store
Longer-term hardening
- Deploy EDR with behavioral detection for process injection into browsers and API hooking of certificate validation
- Monitor NtProtectVirtualMemory calls setting PAGE_EXECUTE_READWRITE on library functions in browser processes
- Implement email filtering, DMARC/SPF/DKIM, and user training against macro-enabled document malspam
- Apply least privilege, disable SMBv1 and restrict SMB traffic, and maintain clean network segments
- Use phishing-resistant MFA and out-of-band transaction verification for banking users
Timeline of TrickBot adds Zeus-style webinject configs (winj) to
- ZeuS banking trojan emerges (CIS gives the year only); its webinject config syntax later becomes the basis for TrickBot's winj format.
- Dyre/Dyreza goes offline (CIS gives the year only); TrickBot later reuses its code.
- TrickBot modular trojan first observed in 2016 (source gives the year only), initially focused on banking fraud and credential theft.
- From June 2019 MS-ISAC observed an increasingly close relationship between initial TrickBot infections and Ryuk ransomware attacks (source gives the month only).
- U.S. Cyber Command and private-sector partners conduct takedown operations against TrickBot in fall 2020 (CIS gives the season only; October used as placeholder start of fall).
- Kryptos Logic Vantage Team observed new TrickBot webinject development in June 2021, after the earlier work had been shelved for over a year; updated module pushed to real victims as injectDll32/injectDll64 with the winj Zeus-style config replacing sinj/dinj.
- Kryptos Logic publishes 'TrickBot and Zeus' documenting the winj config, local SOCKS proxy, self-signed certificate handling, IcedID/Bokbot code overlap, and four SHA256 hashes.
- Kryptos Logic completes the 'Deep Dive into Trickbot's Web Injection' analysis: reflective injection into IE/Firefox/Chrome/Edge, 127.0.0.1:15733 proxy, CT/HPKP header rewriting, three-stage JavaScript injection and C2 domains.
- Unit 42 publishes 'Banking Trojan Techniques', covering webinject and Man-in-the-Browser API hooking across Zeus, Trickbot, IcedID, Emotet and Dridex.
Sources cited for TrickBot adds Zeus-style webinject configs (winj) to
Detection coverage for TL-2026-3838
As of 2026-10-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3838 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.