Threat Profile
| Threat Name | Donut Injector |
|---|---|
| Type | In-memory payload loader / shellcode generator |
| Platform | Windows (all versions) |
| File Type | Windows PE executable (typically injected shellcode) |
| First Documented | 2019 (public release on GitHub) |
| Distribution Method | Phishing attachments, exploit kits, malicious macros, supply chain compromise |
| Primary Risk | Delivers secondary payloads (ransomware, spyware, RATs) without disk writes |
| Known Targets | U.S. organizations, defense contractors, enterprise networks |
| Detection Difficulty | High — operates entirely in memory, minimal forensic footprint |
| Engine Aliases | Donut, donut_injector, Trojan.Inject.Donut (varies by vendor) |
| Data Last Updated | August 2026 (Malpedia) |
| Public Repository | github.com/TheWover/donut (tool misused by attackers) |
How It Spreads
Donut Injector itself doesn't spread autonomously like a worm. Instead, attackers use it as a stealthy delivery vehicle for other malware. The tool converts executable payloads into position-independent shellcode, which can then be injected into legitimate Windows processes. This technique, called process hollowing or reflective loading, allows malicious code to run under the guise of trusted applications like explorer.exe or svchost.exe. The injector typically reaches your machine through initial compromise vectors controlled by the attacker. Once the first-stage malware (a dropper or macro-enabled document) executes, it downloads or decrypts the Donut-generated shellcode and injects it directly into memory. Because the final payload never touches the hard drive as a conventional file, signature-based antivirus often misses it entirely. Symantec's Threat Hunter Team documented this technique in attacks where Donut was used to load Cobalt Strike beacons and other post-exploitation frameworks. Common distribution methods include: - **Phishing emails** with malicious Office documents containing VBA macros that invoke Donut-generated shellcode - **Exploit kits** targeting browser or software vulnerabilities to inject payloads silently - **Software supply chain attacks** where legitimate installers are trojanized with Donut loaders - **Compromised websites** serving drive-by download scripts that execute Donut shellcode - **Lateral movement tools** used by attackers already inside a network to deploy payloads to additional machines - **Malicious PowerShell scripts** downloaded from attacker-controlled servers that decode and execute Donut payloadsWhat It Does On Your Machine
Donut Injector's sole purpose is execution — it exists to run other programs in a way that evades detection. When the injector runs, it allocates executable memory space within a running process, copies the shellcode payload into that space, and transfers execution control to it. The host process continues to appear legitimate in Task Manager and to security software, while the malicious code operates hidden within its memory space. The actual damage depends entirely on what payload Donut delivers. In documented attacks against U.S. defense contractors, threat actors used Donut to load remote access trojans (RATs) that exfiltrated sensitive engineering documents and credentials. Other campaigns have deployed ransomware, credential dumpers like Mimikatz, or network reconnaissance tools. The common thread is stealth: because the payload never appears as a file on disk, traditional forensic analysis often finds no evidence of infection even after data theft or system compromise.Manual Removal — Step by Step
Disconnect from the network immediately
Unplug your Ethernet cable or turn off Wi-Fi. Donut-delivered payloads often communicate with command-and-control servers, and severing the connection prevents further data exfiltration or additional payload downloads.
Boot into Safe Mode with Networking
Restart your computer and press F8 (or Shift+F8 on newer systems) during boot. Select "Safe Mode with Networking" from the Advanced Boot Options menu. This loads only essential drivers and services, often preventing injected payloads from executing.
Run Windows Defender Offline Scan
Open Windows Security, navigate to Virus & Threat Protection, and select "Scan options." Choose "Microsoft Defender Offline Scan" and click "Scan now." This pre-boot environment can detect rootkits and memory-resident threats that hide from standard scans.
Use specialized anti-malware tools
Download Malwarebytes (from another clean computer if necessary) and run a full Threat Scan. Also run HitmanPro or Emsisoft Emergency Kit — these tools use behavioral detection rather than signatures, improving chances of catching fileless payloads.
Check for persistence mechanisms
Open Task Scheduler (taskschd.msc) and review all scheduled tasks, especially those in the Microsoft\Windows folders. Delete any unfamiliar tasks. Also check Startup items using MSConfig (System Configuration) and remove suspicious entries.
Examine running processes in Process Explorer
Download Microsoft's Process Explorer (Sysinternals suite) and run it. Look for processes with unusual parent-child relationships or legitimate processes (like RuntimeBroker.exe or svchost.exe) making network connections to unfamiliar IPs. Right-click suspicious processes and select "Kill Process Tree."
Clear temporary files and caches
Run Disk Cleanup (cleanmgr.exe) and select all options including "Temporary files" and "Downloaded Program Files." Also manually delete contents of %TEMP%, %LOCALAPPDATA%\Temp, and C:\Windows\Temp directories.
Review PowerShell execution logs
Open Event Viewer and navigate to Applications and Services Logs > Microsoft > Windows > PowerShell > Operational. Look for EventID 4104 entries containing Base64-encoded scripts or references to "Invoke-Expression" or "DownloadString." These indicate PowerShell-based injection attempts.
Reset browser settings and credentials
Assume all passwords stored in browsers are compromised. Reset each browser to default settings, then change passwords for banking, email, and other critical accounts from a known-clean device. Enable two-factor authentication wherever possible.
Perform a clean Windows reinstall if uncertainty remains
If scans detect nothing but suspicious behavior persists, or if the infection was discovered on a business machine handling sensitive data, the safest option is a complete Windows reinstall. Back up personal files (scan them on another machine first), then perform a clean install from Microsoft's Media Creation Tool.
Prevention
Preventing Donut Injector infections requires defense-in-depth, since the tool itself is stealthy and the real threat comes from what it delivers:- Enable PowerShell script block logging — Open Group Policy Editor (gpedit.msc), navigate to Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell, and enable "Turn on PowerShell Script Block Logging." This creates forensic records of PowerShell-based injection attempts.
- Disable macros in Office documents — Configure Office applications to disable macros from internet sources. Go to File > Options > Trust Center > Trust Center Settings > Macro Settings and select "Disable all macros except digitally signed macros."
- Deploy application whitelisting — Use Windows Defender Application Control (WDAC) or AppLocker to restrict which executables, scripts, and DLLs can run. This prevents unauthorized code execution even if an attacker gains initial access.
- Keep software fully patched — Enable automatic updates for Windows, browsers, Java, Adobe products, and all other software. Exploit kits frequently deliver Donut payloads through unpatched vulnerabilities.
- Use endpoint detection and response (EDR) tools — Consumer antivirus often misses fileless threats. Small businesses should consider enterprise-grade EDR solutions like Microsoft Defender for Endpoint, CrowdStrike, or SentinelOne that monitor process behavior and memory allocations.
- Implement email filtering and sandboxing — Configure email gateways to quarantine attachments with macros, scripts, or executables. Consider sandbox-based analysis for suspicious emails before they reach user inboxes.
- Restrict administrative privileges — Run user accounts with standard privileges, not admin rights. Many injection techniques require elevated permissions to succeed. Use separate admin accounts only for system maintenance tasks.
- Train users to recognize phishing — Since most Donut infections begin with social engineering, regular security awareness training reduces the likelihood users will open malicious attachments or click dangerous links.