Argamal RAT Windows Color System COM Hijack

Ethan Andrews@eandrews

•updated Jun 3, 2026•3•0•5

Detects modification of the InprocServer32 key for the Windows Color System Calibration CLSID, used by Argamal RAT for persistence. Legitimate Windows Color System components are typically registered in HKLM, not HKCU.