Termncolor Sideloading via Vcpktsvr.exe in Non-Standard Path

Tim Peck@timpeck

•updated Sep 8, 2025•0•22

Detects the loading of `libcef.dll` by `vcpktsvr.exe` from non-standard directories. This specific DLL Sideloading behavior is a key tactic of the malware associated with the Termncolor/Colorinal malicious Python packages, where a legitimate executable is dropped into an unusual location to load a malicious DLL.