There is a new method of remote code execution which we have been seeing lately in the wild using dynamic compiled remote source code. The technical details behind this attack are very interesting and the implications are potentially dangerous if they evolve, so I decided to stay one step ahead and use these concepts to actually do some real damage. I succeeded in creating as POC to infiltrate a number of corporations using this method. Because the binary does not initially contain malicious code, the benign application will pass whitelisting. Only then will the worm hole open, remote malicious source code is streamed into the executable and without spawning a new process or altering the binary itself will be executed. We tested this method and succeeded in bypassing full enforcement white-listing in environments ranging from a small IT company to the corporate headquarters of a large bank. This is the story of how “The Wormhole” was born. Technical details and a live POC will be performed.