Bumblebee DLL Sideloading via consent.exe Loading msimg32.dll from Non-Standard Path

Ibrahim Saud@tektrix

•updated Jun 29, 2026•1•0•3

Detects the Bumblebee loader technique where the Windows UAC consent UI (consent.exe) loads a malicious msimg32.dll from a non-standard, user-controlled path (such as a temporary directory created by a trojanized MSI installer) instead of the legitimate Windows system directory.