Sneaky Shellcode: Windows Fibers Offer EDR-Proof Code Execution

Research presented at Black Hat Asia demonstrates that Windows fibers, a little-used user-mode execution mechanism, can be abused by attackers to stealthily execute code and evade EDRs. The researcher described two PoC techniques — Phantom Thread (masquerading fibers as threads to avoid memory scans and callstack detection) and Poison Fiber (injecting payloads into dormant fibers to trigger execution without suspending threads) — which enable stealthy payload delivery and possible remote code execution; no public release or confirmed active exploitation was reported, but the methods raise notable detection and hunting challenges for defenders.