Moonwalk++ Bypasses EDR by Spoofing Windows Call Stacks

A new Moonwalk++ proof-of-concept (PoC) shows how malware can spoof Windows call stacks while staying encrypted in memory, bypassing modern EDR detection. The research highlights blind spots in stack-based telemetry increasingly relied on by enterprise defenders. “Public detection tools fail entirely to recognize the call stack tampering,” said the researcher. Moonwalk++ Shows the Limits of […]

The post Moonwalk++ Bypasses EDR by Spoofing Windows Call Stacks appeared first on eSecurity Planet.