New IAmAntimalware tool affects popular antivirus processes

A new, sophisticated tool called IAmAntimalware is designed to inject malicious code directly into antivirus software processes, potentially turning protective defenses into hidden backdoors for attackers.

See also: Hackers can inject malicious code into antivirus processes

Released on October 11, 2025 by developer Two Seven One Three on GitHub, it exploits Windows service cloning and digital signature manipulation to bypass antivirus self-protection mechanisms. This development is of concern to the cybersecurity community, as it could allow silent persistence on compromised systems during penetration tests or malicious campaigns.

IAmAntimalware works by cloning legitimate antivirus services, such as those from Bitdefender or Avast, to create identical processes that inherit elevated privileges without raising alarms. The tool modifies the Windows Cryptography API registry under HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider to hijack the cryptography provider, loading a user-controlled DLL in place of trusted modules.

Users provide parameters such as the original service name, the new cloned name, the certificate path for signature cloning, and the absolute DLL path. An optional “P” flag enables Protected Process Light (PPL) support for improved evasion. For scenarios that avoid cryptographic capture, the tool supports manipulation of the COM object CLSID, requiring TrustedInstaller privileges to forge component loading. Signature cloning relies on a companion tool, CertClone , that copies valid Windows certificates such as those from Sysmon , ensuring that the embedded DLL appears legitimate to integrity checks.

See also: Android banking trojan uses VNC server to remotely control devices

This multi-layered approach bypasses common antivirus protections, including process introspection, elevated privilege monitoring, and code signature verification, allowing embedded code to write files or execute commands in protected directories. In demonstrations described by the creator, IAmAntimalware successfully embedded a sample DLL into BDProtSrv , allowing unauthorized files to be created in the antivirus's installation folder, a feat impossible for standard user processes.

Similar tests at Trend Micro and Avast confirmed the effectiveness, although Avast required targeting a GUI process for stability. The embedded code, like a simple backdoor that writes an index file, evades detection by operating inside whitelisted, unkillable processes that antivirus developers are hesitant to terminate to avoid system instability.

Early reports indicate that there is no widespread exploitation yet, but the open-source nature of the tool and its simplicity, written entirely in C++, could accelerate adoption in Red Team or by malicious actors. Security analysts rate the technique medium severity due to its reliance on system access and lack of zero-day exploits, but it highlights vulnerabilities in antivirus trust models.

This tool highlights a critical irony: antivirus processes, granted SYSTEM-level privileges to scan for threats, become prime targets for subversion. By introducing these exceptions to normal security rules, attackers can disable alerts, extract data, or maintain persistence without detection, complicating incident response.

See also: Critical vulnerabilities in Windows Defender Firewall

Mitigation strategies include monitoring unusual module loads in antivirus processes, enforcing strict certificate trust policies, and more rigorous use of PPL to isolate critical services. Experts urge organizations to regularly validate the integrity of antiviruses and consider behavioral endpoint detection tools beyond signature-based checks.