Thread Execution Hijacking

• Instead of creating a thread, repurpose an existing one.
• Steps:
• SuspendThread on a target thread.
• GetThreadContext — read its registers.
• Write shellcode into the target; point the instruction pointer (EIP/RIP) at it via SetThreadContext.
• ResumeThread — the hijacked thread runs your code.
• No CreateRemoteThread, no new thread to flag.