wkspbroker.exe DLL Sideloading from AppData RemoteApp Gateway

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•6

Detects the loading of radcui.dll from the non-standard %LOCALAPPDATA%\Microsoft\RemoteApp\Gateway\ directory. This behavior is associated with DLL sideloading chains where signed Microsoft binaries (such as wkspbroker.exe) are abused to load malicious payloads, often seen in the PREY-0058/Aur0ra Teams vishing campaigns.