What makes PROPagate unique is that it uses Windows APIs to take advantage of the way Windows subclasses its window events. Check out Senior Security Consultant, Scott Nusbaum’s commentary on DarkReading.
Read the article: “Breaking Down the PROPagate Code Injection Attack”