# Cybellum/DoubleAgent

Zero-Day Code Injection and Persistence Technique

Repository: https://github.com/Cybellum/DoubleAgent
Canonical: https://ross.abutalabs.com/products/doubleagent
Language: C
License: Apache-2.0
License Family: permissive
Last push: 2022-08-24T10:32:36+00:00

## Health v2 (maintenance only)
Score: 32/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 3461, "days_push": 1470, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1262, forks 415 (observed 2026-08-28T04:04:10.257866+00:00)

## What it is
DoubleAgent is a research tool and proof-of-concept demonstrating a zero-day code injection and persistence technique on Windows, exploiting a long-standing legitimate OS feature to inject DLLs into any process, including privileged ones. It was released by Cybellum to demonstrate attacks against antiviruses and persistent malware installation.

## Use cases
- inject a DLL into any Windows process at boot
- maintain persistence across reboots on Windows
- test antivirus self-protection mechanisms
- research Windows code injection techniques
- demonstrate privilege escalation via process injection
- evaluate endpoint security resilience to injection attacks

## When to choose
- you are a security researcher studying Windows DLL injection and persistence
- you need to test whether antivirus self-protection blocks code injection
- you want a proof-of-concept for red-team technique demonstrations on Windows

## When to avoid
- you need a supported, production-ready injection framework
- you target non-Windows platforms
- you want actively maintained tooling - the project has not seen significant updates since 2022

## Facets
- artifact type: library
- maturity: maintenance
- function: security, penetration-testing, vulnerability-scanning
- domain: security, penetration-testing, windows
- platform: windows, cpp
- tags: code-injection, dll-injection, persistence, red-team, exploit-research, antivirus-bypass

## Member repositories
- Cybellum/DoubleAgent (main) score 32

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:10.257866+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T05:04:12.546625+00:00, confidence not recorded.
  - readme: https://github.com/Cybellum/DoubleAgent (fetched 2026-08-28T04:04:10.257866+00:00, sha 61047fc78195)
- Data as of 2026-08-30T08:39:29.467469+00:00.