Yes, If any malicious program is running in user land in windows, it can easily bypass UAC. But, as was mentioned when this was being discussed on reddit[0], UA

Yes, If any malicious program is running in user land in windows, it can easily bypass UAC. But, as was mentioned when this was being discussed on reddit[0], UAC was never meant to be a fix-all security boundary. 0: https://www.reddit.com/r/netsec/comments/6e1uft/a_poc_demonstrating_how_uac_was_fundamentally/di733pw/ https://www.reddit.com/r/netsec/comments/6e1uft/a_poc_demons...