Windows SmartScreen bug exploited to deliver powerful info-stealer (CVE-2023-36025)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-36025 | Windows SmartScreen Bypass (CVE-2023-36025) Exploited via Crafted Shortcut Files CVE-2023-36025 is a security feature bypass in Windows SmartScreen in which a specially crafted file — exploited in the wild using Internet Shortcut (.url) files — evades the Mark-of-the-Web warning SmartScreen normally displays for content downloaded from the internet. The flaw is network-reachable and requires no authentication, but user interaction is required: it triggers when a user clicks the crafted file delivered via phishing email, chat, or a web download. By bypassing the SmartScreen prompt, the attacker removes a key user-facing defense that would otherwise flag or warn about the file, which facilitated delivery of malware in the observed DarkGate and Mispadu campaigns. Any unpatched Windows 10 (1507, 1607, 1809, 21H2, 22H2), Windows 11 (21H2, 22H2, 23H2), or Windows Server 2008/2012/2016/2019 system is affected, which at the time of disclosure effectively meant the entire supported Windows installed base. It is confirmed exploited in the wild: CISA added it to the KEV catalog on 2023-11-14, EPSS scores 30-day exploitation probability at 88.1% (100th percentile), though no public PoC is known. Do: Apply Microsoft's November 2023 cumulative Windows security updates (the release containing the fix) on all affected Windows 10/11 and Windows Server systems; no configuration-based workaround is widely documented, so patching is the primary mitigation. Until patched, treat unexpected Internet Shortcut (.url) files arriving via email or chat with extra suspicion, since they can execute without the usual SmartScreen warning, and hunt for DarkGate/Mispadu indicators. Given the KEV listing and 88.1% EPSS, prioritize this fix in the current patch cycle; ransomware-associated use is reported as unknown. | 8.8 | 88% | KEV |
| mass>1 billion endpoints (effectively the entire supported Windows 10/11/Server installed base at the time of disclosure) |
Full article474 words · extracted from helpnetsecurity.com · click to collapse
A vulnerability (CVE-2023-36025) that Microsoft fixed in November 2023 continues to be exploited by malware peddlers: this time around, the delivered threat is a variant of the Phemedrone Stealer.
About the malware
Phemedrone Stealer is a piece of malware written in C#, with no dependencies. It’s capable of:
- Collecting system information (hardware, OS, geolocation) and making screenshots
- Gathering all data contained in the targed device’s memory
- Grabbing user files from specific folders (e.g., Documents, Desktop)
- Grabbing cookies, passwords, and autofills from Chromium-based browsers (Google Chrome, Microsoft Edge, Opera, Brave, etc.) and Gecko-based browsers (e.g., Firefox)
- Extracting sensitive data from password and authenticator apps via extensions installed on Chromium-based browsers
- Grabbing Discord authentication tokens and files related to Steam and Telegram authentication-related files
- Extracting files from popular cryptocurrency wallet apps
- Capturing connection details and credentials for FileZilla (a free FTP solution)
The harvested data is compressed and exfiltrated via the Telegram API.
CVE-2023-36025 exploited
Exploiting CVE-2023-36025 allows attackers to bypass Windows Defender SmartScreen checks and associated prompts, which means that when the victim is tricked into dowloading and opening a malicious file, Windows won’t warn them against it if the service finds the file (or website) suspicious and potentially malicious.
Microsoft released fixes for CVE-2023-36025 on November 2023 Patch Tuesday and warned at the time that the vulnerability was already being leveraged in attacks in the wild.
A week after, the company confirmed that a proof-of-concept exploit had been made public. (Other PoCs and demos have been published since then.)
The vulnerability has previously been abused by attackers to deliver the Remcos, DarkGate and NetSupport remote access trojans.
In this latest campaign, the final malicious payload is the Phemedrone Stealer.
Trend Micro researchers didn’t say how victims are tricked into downloading malicious Internet Shortcut files (.url) hosted on Discord or other cloud services such as FileTransfer.io, but they know that once they execute it, an exploit for CVE-2023-36025 is triggered and a DLL file masquerading as a control panel item (.cpl) file is downloaded.
Phemedrone Stealer’s infection chain (Source: Trend Micro)
“When the malicious .cpl file is executed through the Windows Control Panel process binary, it in turn calls rundll32.exe to execute the DLL. This malicious DLL acts as a loader that then calls on Windows PowerShell to download and execute the next stage of the attack, hosted on GitHub,” they explained.
A number of additional files and scripts are downloaded to achieve persistence and second-stage defense evasion so that Phemedrone Stealer can be installed.
Act now: it may be late, but not too late
“Threat actors continue to find ways to exploit CVE-2023-36025 and evade Windows Defender SmartScreen protections to infect users with a plethora of malware types,” the researchers noted.
Organizations that haven’t yet updated their Microsoft Windows installations to fix CVE-2023-36025 are urged to do it quickly.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2024/01/15/cve-2023-36025-exploited/