Researchers have recently discovered a new zero-day vulnerability, which allows them hackers to perform malware(opens in new tab) in Windows, without the victim's PC displaying any kind of warning
The new vulnerability, which has reportedly not yet been patched by Microsoft, allows hackers to bypass the Mark of the Web, which is a Windows protection method that flags files downloaded from untrusted Internet sites as dangerous.
The malware being distributed is the Qbot (AKA Quakbot), an old and well-known trojan that targets bank accounts, but still poses a significant threat to victims.
Running infected ISO files
The distribution of the malware starts with a phishing email that contains a link to one ZIP file which is password protected.
This link then downloads to the PC a disc image file in format .IMG either as one .ISO file, which if appended (become Mount) on the victim's PC, a standalone appears JavaScript file with malformed signatures, a text file and a folder with a file . Dll.
The JavaScript file carries a VB script which reads the contents of the text file, which trigger its execution .DLL file.
As Windows does not correctly read the labels of ISO image files with the labeling Mark of the Web, they are allowed to launch the installation without any warning. On PCs running Windows 10 or later, simply double-clicking a disk image file automatically mounts the file as a new drive letter.
This is not the first time that hackers have exploited vulnerabilities in the Mark of the Web. Recently they even tried to develop a similar method for its distribution Magniber ransomware, as he says BleepingComputer.
Η Microsoft apparently he knew of this vulnerability from October of 2022, but it hasn't released a patch yet, and we assume it will go ahead with releasing an UPDATE this coming December.
Do not forget to follow it Xiaomi-miui.gr on Google News to be informed immediately about all our new articles! You can also if you use RSS reader, add our page to your list by simply following this link >> https://news.xiaomi-miui.gr/feed/gn
Follow us on Telegram so that you are the first to learn our every news!
