AnyDesk Printer COM Hijack - Attacker-Controlled DLL Loaded by AnyDesk

Ethan Andrews@eandrews

•updated Jun 28, 2026•0•0•6

Detects the AnyDesk.exe process loading a DLL from non-standard, user-writable directories (e.g., AppData, Temp, Downloads). This behavior is indicative of a Component Object Model (COM) hijacking attack where an attacker registers a malicious COM server to trick AnyDesk's printer component into loading an arbitrary DLL, potentially enabling privilege escalation or persistent code execution.