Hackers Abuse OneDrive.exe via DLL Sideloading to Run Malicious Code

Security researchers have disclosed a sophisticated attack that abuses OneDrive.exe through DLL sideloading to run attacker-controlled code, a technique highlighted in GBHackers On Security on 5 November 2025. The method hinges on Windows loading libraries in a predictable order: by placing a malicious version.dll in the same folder as OneDrive.exe, attackers cause OneDrive to load their code instead of the legitimate Microsoft library, enabling code execution within the OneDrive process context.

The payload uses DLL proxying to export the same functions as the real library, forwarding calls to the genuine system DLL to keep OneDrive running while the attacker’s code operates in the background, with advanced API hooking via Vectored Exception Handling and memory protection to avoid detection.

The demonstration shows arbitrary code execution with a two-second delay after DLL injection, after which a privileged process is launched; in real attacks, this could mean ransomware, credential theft, backdoors, or command-and-control activities.

Organisations relying on OneDrive for file synchronisation face heightened risk due to the application's persistent elevated permissions and network access, and defenders are urged to monitor for rogue DLLs, restrict library loading locations, and enable file integrity monitoring in critical directories, according to GBHackers On Security.