TrymeLocker IFEO Hijacking of Accessibility Tools via Debugger Registry Key

Ibrahim Saud@tektrix

•updated Jun 28, 2026•2•0•3

Detects the modification of Image File Execution Options (IFEO) registry keys to assign a debugger to critical Windows accessibility binaries (e.g., sethc.exe, utilman.exe, osk.exe). This technique is a common method for achieving persistence or privilege escalation by executing arbitrary code when these accessibility features are triggered, often at the Windows login screen.