Lunar Client Electron Preload IPC Privilege Escalation via sendMessage

Ethan Andrews@eandrews

•updated Jun 28, 2026•0•0•1

Detects the spawning of suspicious child processes (e.g., cmd.exe, PowerShell, node.exe, calc.exe) by the Lunar Client application. This behavior is indicative of an exploit targeting the Electron framework's preload IPC bridge, allowing a renderer process to execute commands or gain elevated privileges on the host system.