CALL STACK SPOOFING EXPLAINED USING APT41 MALWARE

Summary from the TLDR InfoSec newsletter

Call stack spoofing is a technique to hide suspicious activity from security software like EDR by mimicking a legitimate call stack. A malware called DodgeBox used by APT41 implemented this technique to trick antivirus software. By creating a fake call stack, the malware obscures the true origin of function calls, making detection more challenging.