OceanLotus SPECTRALVIPER Injection into OneDrive Sync Service

Kaung Khant Ko@kaungkhantko

•updated Jun 12, 2026•2•0•7

Detects process injection attempts targeting the OneDrive.Sync.Service.exe process. This behavior is associated with the OceanLotus SPECTRALVIPER backdoor, which uses it to maintain persistence and evade defense mechanisms.