A new malware technique leverages Windows’ UI Automation (UIA) framework, enabling stealthy malicious operations while bypassing endpoint detection and response (EDR) tools. This method exploits Windows accessibility features designed to assist users with disabilities, transforming them into a vector for cyberattacks.
How the Exploit Works
According to Akamai security researcher Tomer Peled, attackers must first trick users into running a program utilizing UI Automation. Once activated, this approach can execute commands, harvest sensitive data, redirect browsers to phishing sites, and even manipulate messaging apps like Slack and WhatsApp.
“This can lead to stealthy command execution,” Peled explained. “Attackers can harvest sensitive data, redirect browsers, and manipulate UI elements, often without triggering security alerts.”
Windows UI Automation
Introduced with Windows XP as part of the Microsoft .NET Framework, UI Automation provides programmatic access to UI elements. Originally designed to assist users through screen readers and other accessibility tools, it also supports automated testing by developers.
Microsoft highlights in its documentation that accessibility applications need privileged access to system UI elements, often requiring elevated permissions. “Assistive technology applications must run with special privileges,” Microsoft states. This trusted access, however, makes UI Automation a prime target for malicious actors.
Attackers can exploit this trust model by creating UIA objects that interact with on-screen applications using the Component Object Model (COM). This inter-process communication (IPC) mechanism enables direct access to UI elements of targeted applications.
Peled’s research reveals that attackers can read and modify browser content, steal data from online forms, and send messages through chat applications — often without the victim noticing. This is because UI elements can be preloaded into a cache, making them accessible even if not visibly displayed.
Why EDR Solutions Struggle
Since UI Automation’s capabilities are legitimate Windows features, EDR tools struggle to detect abuse. The system views these interactions as standard accessibility operations, not malicious activity. “Since UIA’s permissions exist for accessibility purposes, Defender perceives them as normal,” Peled explained.
This parallels how Android’s accessibility services have been exploited by mobile malware for data theft and screen manipulation.
From COM to DCOM: An Emerging Attack Vector
Adding to the concern, Deep Instinct recently disclosed a method to exploit Distributed COM (DCOM) for remote attacks. DCOM allows software components to communicate over a network, making it a potential lateral movement tool in enterprise environments.
Security researcher Eliran Nissan explained how attackers could deploy backdoors by writing custom DLLs to target machines and executing them using arbitrary parameters. This technique abuses the IMsiServer COM interface, enabling attackers to load and run payloads stealthily.
However, Nissan noted that DCOM-based attacks leave clear indicators of compromise (IoCs), making them detectable. Still, the risk persists if attackers and victims share the same domain.
“DCOM Upload & Execute enables writing custom payloads remotely,” Nissan said. “The method effectively functions as an embedded backdoor, exploiting unexpected DCOM objects for lateral movement.”
Recommendations
Given these emerging threats, organizations should consider the following mitigation strategies:
Enhance EDR Detection Rules: Security teams should configure EDR solutions to flag unusual UI Automation activity, even if it appears legitimate.
Limit Accessibility Privileges: Restrict accessibility tool permissions where possible to reduce the attack surface.
Network Segmentation: Isolate critical assets from general user domains to limit lateral movement.
Monitor for IoCs: Conduct regular audits to detect unusual COM or DCOM-related activity.
Security Training: Educate users on the risks of running unknown programs, especially those requesting elevated permissions.
Summary
As attackers continue to exploit legitimate system features, cybersecurity defenses must adapt. The dual-use nature of frameworks like UI Automation underscores the importance of context-aware security solutions. Organizations should invest in behavior-based monitoring and advanced threat intelligence to stay ahead of evolving threats.
Follow us on 
(Twitter) for real time updates and exclusive content.
Interesting Article : Zero-Day Exploit in Cleo File Transfer Tools Sparks Global Security Alert