# Signed binary DLL sideloading

Signed executables loading unsigned or renamed DLLs from writable app, working, or install directories

_Area: Software supply chain and CI/CD. Seen in 2 disclosed reports; latest 2026-10-27. Updated 2026-11-07._

## How it works

Windows resolves a DLL import by searching directories in a fixed order, and the application's own directory comes before system paths. A signed executable proves only that the executable is authentic; it does not vouch for the DLLs it loads. If a signed host sits in a directory an attacker can write to (a ZIP release folder, a user profile, a temp extraction path), dropping a DLL with the expected name beside it makes the trusted, signed process load attacker code. The signature check passes, the process looks legitimate, and the malicious DLL inherits the host's trust and often its privileges [E1](https://bugbountylibrary.com/r/blog%3Aresearch-checkpoint-com-2026-tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries.md)[E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-targeted-apt-activity-babyshark-is-out-for-blood.md)[E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-ghostpulse-haunts-victims-using-defense-evasion-bag-o-tricks.md).

## Where it shows up

- Signed installers or updaters shipped as ZIPs where the host EXE and its DLLs share a writable folder [E1](https://bugbountylibrary.com/r/blog%3Aresearch-checkpoint-com-2026-tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries.md)[E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-ghostpulse-haunts-victims-using-defense-evasion-bag-o-tricks.md)
- Signed binaries renamed to a different name (e.g. an updater renamed to VBoxSVC.exe) so their expected DLL set changes [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-ghostpulse-haunts-victims-using-defense-evasion-bag-o-tricks.md)
- Legitimate signed hosts (OneDrive.exe, updater binaries) placed or copied into user-writable paths [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-targeted-apt-activity-babyshark-is-out-for-blood.md)[E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-ghostpulse-haunts-victims-using-defense-evasion-bag-o-tricks.md)
- DLLs whose export table is stripped to `C3`/`90` stubs, or that are unsigned/renamed beside a signed EXE [E1](https://bugbountylibrary.com/r/blog%3Aresearch-checkpoint-com-2026-tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries.md)
- Loader code that hashes the expected host basename before acting [E1](https://bugbountylibrary.com/r/blog%3Aresearch-checkpoint-com-2026-tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries.md)
- MSIX/App Installer packages signed with purchased or stolen certificates [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-ghostpulse-haunts-victims-using-defense-evasion-bag-o-tricks.md)

## How to review

The invariant: every DLL a signed host loads must come from a directory the attacker cannot write to, or must itself be signed and validated. Check the import table of each shipped signed EXE and confirm each imported DLL resolves to a trusted, non-writable location (System32, a protected install dir), not the app or working directory. Confirm the host does not call `SetDllDirectory`/`LoadLibrary` with a relative path, and that renamed hosts still find their real DLLs. For installers, verify the extraction directory is not user-writable before the host runs, and that the package signature covers the DLLs, not just the EXE.

## How finders spotted it

- Compared ZIP contents against compilation timestamps: a `winmm.dll` compiled the same day it was added stood out among decoy files, and a stripped export table confirmed the spoof [E1](https://bugbountylibrary.com/r/blog%3Aresearch-checkpoint-com-2026-tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries.md)
- Started from a scheduled-task persistence hit, pulled the referenced cloud page with curl, and noticed odd custom delimiters in the filename that matched known APT tooling [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-targeted-apt-activity-babyshark-is-out-for-blood.md)
- Used AV scan logs showing a failed ZIP scan as a lead, then cracked the archive password and ran olevba to expose the macro [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-targeted-apt-activity-babyshark-is-out-for-blood.md)
- Unpacked signed MSIX samples and traced the PowerShell decryption chain to the sideloaded DLL [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-ghostpulse-haunts-victims-using-defense-evasion-bag-o-tricks.md)

## Variants seen

- Malicious DLL dropped beside a signed installer in a ZIP release [E1](https://bugbountylibrary.com/r/blog%3Aresearch-checkpoint-com-2026-tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries.md)
- Version DLL placed beside OneDrive.exe for hijack [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-targeted-apt-activity-babyshark-is-out-for-blood.md)
- Renamed signed updater sideloading a trojanized libcurl.dll, delivered via signed MSIX [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-ghostpulse-haunts-victims-using-defense-evasion-bag-o-tricks.md)

## Impact and severity

High: signed-host sideloading yields code execution under a trusted process, often escalating to Local System via scheduled tasks [E1](https://bugbountylibrary.com/r/blog%3Aresearch-checkpoint-com-2026-tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries.md), long-term espionage with RAT and multiple C2 channels [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-targeted-apt-activity-babyshark-is-out-for-blood.md), or info-stealer injection [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-ghostpulse-haunts-victims-using-defense-evasion-bag-o-tricks.md). Impact rises with admin rights, persistence, and the loader's ability to deliver arbitrary payloads [E1](https://bugbountylibrary.com/r/blog%3Aresearch-checkpoint-com-2026-tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries.md)[E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-ghostpulse-haunts-victims-using-defense-evasion-bag-o-tricks.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aresearch-checkpoint-com-2026-tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries.md
- E2: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-targeted-apt-activity-babyshark-is-out-for-blood.md
- E3: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-ghostpulse-haunts-victims-using-defense-evasion-bag-o-tricks.md