New IAmAntimalware Tool Injects Malicious Code Into Processes Of Popular Antiviruses
The IAmAntimalware tool is a newly developed software designed to inject malicious code into antivirus processes, potentially creating vulnerabilities within protective systems.
The IAmAntimalware tool is a newly developed software designed to inject malicious code into antivirus processes, potentially creating vulnerabilities within protective systems.
Released on October 11, 2025, by Two Seven One Three on GitHub, IAmAntimalware exploits Windows service cloning and digital signature manipulation to bypass antivirus self-protection features.
The tool has significant implications for cybersecurity, enabling stealthy persistence on compromised systems during penetration testing or malicious activities.
IAmAntimalware clones legitimate antivirus services, allowing for the creation of identical processes that inherit elevated privileges without detection. It modifies the Windows Cryptography API registry to hijack cryptographic providers, loading user-controlled DLLs instead of trusted modules.
Users can specify parameters such as the original service name, new cloned name, certificate path for signature cloning, and the DLL path. An optional "P" flag enables Protected Process Light (PPL) support for enhanced evasion.
In scenarios avoiding cryptographic hijacking, the tool supports COM object CLSID manipulation, requiring TrustedInstaller privileges. Signature cloning uses a companion tool, CertClone, to duplicate valid Windows certificates, ensuring injected DLLs appear legitimate.
IAmAntimalware clones legitimate antivirus services, allowing for the creation of identical processes that inherit elevated privileges without detection.
This multi-layered approach circumvents common antivirus safeguards, allowing the injected code to write files or execute commands in protected directories.
Tests demonstrated the tool's ability to inject a DLL into Bitdefender's BDProtSrv process, enabling unauthorized file creation within the antivirus installation folder. Similar tests on Trend Micro and Avast confirmed its effectiveness, though Avast required a GUI process targeting stability.
The tool allows injected code to evade detection by operating within trusted processes that antivirus developers avoid terminating to prevent system instability.
While there are no widespread exploitation reports yet, the tool's open-source nature and simplicity, written in C++, could lead to its adoption in red team exercises or by threat actors.
Security analysts rate the technique medium severity due to its reliance on system access and lack of zero-day exploits, highlighting vulnerabilities in antivirus trust models.
Mitigation strategies include monitoring unusual module loads, enforcing strict certificate trust policies, and leveraging PPL to isolate critical services. Organizations are urged to validate antivirus integrity regularly and consider endpoint detection tools with behavioral analytics.
As the tool gains attention, vendors like Microsoft and antivirus providers face pressure to address service cloning vulnerabilities.
Although intended for ethical penetration testing, IAmAntimalware demonstrates how defensive tools can be misused, necessitating vigilant updates in an evolving threat landscape.
Based on reporting by Cyber Security News.