Code Injection

An app's Mach-O binary resolves a dynamic library by a weak or relative path; placing a malicious dylib where the loader looks first runs attacker code with the host app's privileges.

Forcing the dynamic linker to load an attacker-supplied shared object before libc, letting it override arbitrary library functions process-wide — the classic Linux userland rootkit primitive.

Attaching to a running process with ptrace and hijacking its execution to call dlopen on an attacker-supplied .so — the Linux analogue of Windows CreateRemoteThread DLL injection.

Obtaining a Mach send right to a target's task port with task_for_pid, then writing and running code in its address space — the macOS analogue of CreateRemoteThread injection, gated by SIP and entitlements.

Injecting code without WriteProcessMemory by mapping a shared section into both the local and remote process, writing shellcode through the local view, then executing it from the remote view.

Hijacking a GUI process by patching an entry in its PEB KernelCallbackTable to point at injected shellcode, then triggering execution with a window message such as WM_COPYDATA.

Loading a benign signed DLL into a target process and overwriting its code section with shellcode, so the malicious memory is backed by a legitimate module and evades unbacked-memory scanners.

Marking a payload file delete-pending before mapping it into a section and creating a process, so the executable is gone from disk by the time the process runs — leaving no scannable image file.

Abuses NTFS transactional (TxF) file operations to run a process image from a transacted, never-committed file, leaving no malicious file on disk.

Malware places a trojan DLL in a directory searched before the legitimate library location, causing Windows to load the malicious version when the target application starts.

Malware stores shellcode in the Windows global Atom Table via GlobalAddAtom, then uses NtQueueApcThread to force a target process to copy and execute it, bypassing traditional injection defences.

Malware suspends an existing thread in a target process, overwrites its instruction pointer via SetThreadContext, and resumes it to redirect execution to injected shellcode.

Malware installs a global Windows message hook via SetWindowsHookEx to force its DLL into target processes, executing code whenever a hooked event fires.

Malware queues a shellcode pointer to a target thread's APC queue via QueueUserAPC, executing it when the thread enters an alertable wait state.

The classic remote DLL injection technique: allocate a DLL path in a target process, write it, then spawn a remote thread starting at LoadLibrary to map the DLL into the victim.

Loading a DLL straight from memory by implementing the Windows loader inside the payload itself, so no DLL is ever written to disk or registered in the process module list.

Spawning a legitimate process in a suspended state, unmapping its image and replacing it with malicious code before resuming — runs malware under a trusted process name.

Queues a user-mode APC to the main thread of a process created suspended, so the payload runs at the first alertable wait before the real entry point executes or EDR userland hooks settle.