Malwarehigh
Microsoft MSHTML Flaw Exploited to Deliver MerkSpy Spyware Tool
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-40444 | Remote Code Execution via MSHTML Rendering Engine in Microsoft Windows/Office (CVE-2021-40444) | 8.8 | 98% | KEVRansomwarePoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | authen-connexion.info | into clicking on bogus credential harvesting pages ("signin.authen-connexion[.]info/icloud") in order to continue using the services. "The ma |
| ipv4 | 45.89.53.46 | extension. All this information is transmitted to the URL "45.89.53[.]46/google/update[.]php." The development comes as Symantec d |
From the original article
2 min read at thehackernews.com
Unknown threat actors have been observed exploiting a now-patched security flaw in Microsoft MSHTML to deliver a surveillance tool called MerkSpy as part of a campaign primarily targeting users in Canada, India, Poland, and the U. S.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.