Python Loader Invoking Windows Fiber APIs for In-Memory Shellcode Execution

Duo Tech@duotech

•updated Jul 20, 2026•1•0•1

Detects Python processes attempting to execute shellcode in-memory by invoking Windows Fiber APIs (CreateFiber, ConvertThreadToFiber, SwitchToFiber) in conjunction with memory allocation via VirtualAlloc. This pattern is commonly used in fileless execution techniques where shellcode is manually managed within the process address space, bypassing standard process creation mechanisms.