PhantomBuffer: Effective EDR Evasion Through Stealth Injection

Attack Techniques & Methods2026-10-22, 07:32
A new technique, PhantomBuffer, enables stealthy payload injection into a target process without relying on the well-known APIs — WriteProcessMemory and VirtualAllocEx. Instead, it leverages legitimate Windows mechanisms to conceal injection activity.
Why it works
  1. Payload delivery without WriteProcessMemory. Instead of writing to memory, it uses SendMessageW with the WM_SETTEXT message. The payload is sent as text to an edit control (for example, in Notepad on Windows 10 or in regedit.exe on Windows 11), and the system copies it into the target process's memory.
  2. Hijacking execution flow through a legitimate debugger. Instead of using suspicious APIs such as SetThreadContext, it leverages cdb.exe, a debugger included in the Windows Debugger Tools. It attaches to the process and sets the instruction pointer register (RIP) to the payload's address. Since debuggers are legitimate developer tools, their use may appear less suspicious.
The PoC consists of two utilities: • FindTargetWindows.exe — searches for GUI processes with suitable input controls. If none are found, it can launch a suitable process. • PhantomBuffer.exe — the main tool, which delivers the payload, locates it in memory, and redirects a thread's execution to it using cdb.exe.
Limitations: • A suitable input control is required. The technique won't work without a target process containing an appropriate GUI control. • The null-byte issue. Payloads containing two consecutive null bytes (0x00 0x00) may not be written correctly to the target process, as text-based transmission can truncate the data. • Debugger path. Some security tools may flag cdb.exe if it is launched from a nonstandard location. Using the default installation path for the Windows Debugger Tools may reduce suspicion.
Article: https://www.zerosalarium.com/2026/10/PhantomBuffer-Effective-EDR-Evasion-Stealth-Injection.html Tools: https://github.com/TwoSevenOneT/PhantomBuffer
Vendors
Products
More