DLL Side-Loading

Execute code from an attacker-controlled DLL by placing it in a directory the Windows loader will search for a requested dependency of a legitimate application, then invoking that application. DLL side-loading depends on the target application's actual dependencies, load APIs, package context, and search order; merely placing a DLL beside any executable does not ensure it will load. A trusted or signed loader can affect how execution appears, but signing is neither a loading prerequisite nor a guaranteed application-control bypass. CEF documents libcef.dll as the shared Windows runtime library used by CEF applications; Trend Micro documented a malicious same-named sample loaded by a legitimate Adobe Licensing WF Helper. The filename alone does not establish that a particular copy is malicious.