Binary shadowing is an attack technique where a malicious executable is named the same as a trusted tool, such as git.exe or another helper binary. If software launches programs by bare name instead of a full path, the operating system may search the current directory or application directory first and run the attacker’s file. This turns a normal-looking folder into an execution trap.
This matters because it can create arbitrary code execution from simple actions like opening a project or starting a build. Defenses include using fully qualified paths, limiting executable search locations, validating the working directory, and treating untrusted repositories as active content. On Windows, this pattern is closely related to current-directory hijacking and other process-creation search-order bugs.