Moonwalk++ PoC Demonstrates Malware Call Stack Spoofing to Evade Detection

Security researchers have unveiled Moonwalk++, a dangerous technique allowing malware to fake Windows call stacks and bypass modern endpoint detection systems, exposing critical blind spots in how EDR tools validate sensitive function calls.

The advanced evasion method builds on prior Stack Moonwalking research, demonstrating that attackers can forge the call chain in system memory, making malicious code appear to originate from legitimate software.

This directly challenges security products like Elastic Security, which heavily rely on call stack analysis to identify suspicious API activities.

How the Attack Works

Moonwalk++ exploits Windows’ function call tracking mechanism. Typically, when malware invokes sensitive APIs, such as process creation or memory allocation, security tools examine the call chain to trace the attack’s origin.

The technique manipulates this chain to hide the real attacker and redirect suspicion to legitimate Windows system functions.

What distinguishes Moonwalk++ from earlier variants is its ability to encrypt malicious code during execution.

Previous Stack Moonwalking implementations couldn’t maintain this stealth because encryption would disrupt the specific execution patterns required for the technique.

The new version overcomes this limitation through sophisticated stack manipulation, enabling persistent evasion.

Researchers tested their proof-of-concept against popular detection tools Hunt-Sleeping-Beacons, Get-InjectedThreadEx, and Hollow’s Hunter, all of which failed to detect Moonwalk++ when injected into legitimate Windows processes like OneDrive.exe.

The technique evades detection by removing direct references to malicious code, creating false legitimate Windows origins, and concealing suspicious memory regions.

This research underscores the limitations of relying solely on call stack analysis. The cat-and-mouse game between attackers and defenders continues escalating as adversaries develop increasingly sophisticated evasion techniques.

Defense strategies must evolve beyond stack inspection to incorporate behavioral analysis, memory pattern monitoring, and API usage frequency tracking.

Security teams should implement multi-layered detection approaches that combine multiple telemetry sources rather than relying on a single detection vector.

The authors have released their proof-of-concept code publicly on GitHub, providing security researchers and defenders with technical details to study advanced evasion mechanisms and strengthen defensive capabilities.

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.