Process Injection into ImagingDevices.exe

Aaron Mog@AaronMogS2S

•updated Jul 25, 2025•1•22

Detects process injection into ImagingDevices.exe, a technique observed in the 'Illusory Wishes' campaign to evade detection. The threat actor used trojanized versions of Element and VLC to inject shellcode into this legitimate Windows process.