Suspicious AutoHotKey Execution from Initial Access Vector

Mehulkumar Savajani@Msavajani

•updated Dec 18, 2025•15•1•139

Detects the execution of the AutoHotKey interpreter (AutoHotKey.exe) as a child process of common initial access applications like web browsers, Microsoft Office products, or command-line interpreters. This behavior is a key indicator of the latest DarkGate malware infection chain.