Malware Hiding in a Fake System32 Directory Using NTFS Trailing-Space Trick

CriticalLY 5 hours ago

I came across an interesting NTFS behavior where adding a trailing space in a Windows directory path creates a “ghost” folder that Explorer and most tools can’t display or access normally.

Attackers can abuse this to drop files inside what appears to be the real System32 directory, making the content extremely hard to notice.

I wrote a short breakdown with examples and behavior analysis.

Borg3 2 hours ago
At least, my Cygwin quickly complain there is sth wrong:
```
  % mkdir '//?/c:/test123 '
  % ls
  ls: test123 : No such file or directory
```
Still, ls work if test123 is shadowed.
```
  % ls -d test123*
  test123/  test123 /
```
But at least, you see it :)