GhostTree Attack Abused Recursive Windows Junctions to Hide Malware

Security researchers have discovered a novel technique, dubbed "GhostTree," used by attackers to evade detection by security tools. This method leverages recursive loops created using NTFS junctions to hide malicious files within Windows file systems. Attackers create junctions that point back to their parent directori…