Cybellum/DoubleAgent

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1262 stars · 415 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

DoubleAgent is a research tool and proof-of-concept demonstrating a zero-day code injection and persistence technique on Windows, exploiting a long-standing legitimate OS feature to inject DLLs into any process, including privileged ones. It was released by Cybellum to demonstrate attacks against antiviruses and persistent malware installation.

Use cases

• inject a DLL into any Windows process at boot
• maintain persistence across reboots on Windows
• test antivirus self-protection mechanisms
• research Windows code injection techniques
• demonstrate privilege escalation via process injection
• evaluate endpoint security resilience to injection attacks

When to choose

• you are a security researcher studying Windows DLL injection and persistence
• you need to test whether antivirus self-protection blocks code injection
• you want a proof-of-concept for red-team technique demonstrations on Windows

When to avoid

• you need a supported, production-ready injection framework
• you target non-Windows platforms
• you want actively maintained tooling - the project has not seen significant updates since 2022

Facets

library · maturity maintenance

security penetration-testing vulnerability-scanning security penetration-testing windows windows cpp code-injection dll-injection persistence red-team exploit-research antivirus-bypass

Member repositories

For agents

markdown · JSON · MCP: product_card(name="Cybellum/DoubleAgent")