PhantomCtx — a tool for Execution Flow hijacking via Activation Context

PhantomCtx automates the Activation Context hijacking technique to replace DLLs within trusted, signed executables (e.g., Microsoft, Adobe, Mozilla). Unlike classical DLL hijacking, it doesn't rely on a vulnerable executable — replacement occurs during DLL resolution via the Import Address Table (IAT) or through calls to LoadLibrary.

Its implementation avoids common operations such as NtWriteVirtualMemory or CreateActCtxW, reducing the typical indicators detected by EDR systems.

Capabilities: 📍 Three operating modes: recon, spawn, runtime — reconnaissance, execution, and injection into a live process 📍 Activation Context replacement by NtUnmapViewOfSection and mapping a modified manifest file back into the same memory region 📍 Operates without directly writing into another process's memory (EDR‑evading) 📍 Extracts and modifies another process's Activation Context to alter DLL redirection rules 📍 Modular structure for step‑by‑step execution of an attack scenario

Functionally, PhantomCtx is close to the research project Eclipse, which demonstrated the use of Activation Context Hijacking. However, PhantomCtx employs a different, more covert approach to replacing the Activation Context.

📎 Tool: https://github.com/r3xmax/PhantomCtx