Phemedrone Stealer Targets Windows Defender Flaw Despite Patch
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-36025 | Windows SmartScreen Bypass (CVE-2023-36025) Exploited via Crafted Shortcut Files CVE-2023-36025 is a security feature bypass in Windows SmartScreen in which a specially crafted file — exploited in the wild using Internet Shortcut (.url) files — evades the Mark-of-the-Web warning SmartScreen normally displays for content downloaded from the internet. The flaw is network-reachable and requires no authentication, but user interaction is required: it triggers when a user clicks the crafted file delivered via phishing email, chat, or a web download. By bypassing the SmartScreen prompt, the attacker removes a key user-facing defense that would otherwise flag or warn about the file, which facilitated delivery of malware in the observed DarkGate and Mispadu campaigns. Any unpatched Windows 10 (1507, 1607, 1809, 21H2, 22H2), Windows 11 (21H2, 22H2, 23H2), or Windows Server 2008/2012/2016/2019 system is affected, which at the time of disclosure effectively meant the entire supported Windows installed base. It is confirmed exploited in the wild: CISA added it to the KEV catalog on 2023-11-14, EPSS scores 30-day exploitation probability at 88.1% (100th percentile), though no public PoC is known. Do: Apply Microsoft's November 2023 cumulative Windows security updates (the release containing the fix) on all affected Windows 10/11 and Windows Server systems; no configuration-based workaround is widely documented, so patching is the primary mitigation. Until patched, treat unexpected Internet Shortcut (.url) files arriving via email or chat with extra suspicion, since they can execute without the usual SmartScreen warning, and hunt for DarkGate/Mispadu indicators. Given the KEV listing and 88.1% EPSS, prioritize this fix in the current patch cycle; ransomware-associated use is reported as unknown. | 8.8 | 88% | KEV |
| mass>1 billion endpoints (effectively the entire supported Windows 10/11/Server installed base at the time of disclosure) |
Full article407 words · extracted from infosecurity-magazine.com · click to collapse
Cybersecurity experts have uncovered the active exploitation of CVE-2023-36025, which also led to the dissemination of a new strain of malware called Phemedrone Stealer.
This malware explicitly targets web browsers and collects data from cryptocurrency wallets and messaging applications like Telegram, Steam and Discord.
Additionally, Phemedrone gathers system information, including hardware details and location, sending the stolen data to the attackers through Telegram or their command-and-control (C2) server.
The vulnerability in question impacts Microsoft Windows Defender SmartScreen, resulting from inadequate checks on Internet Shortcut (.url) files.
Threat actors leverage this loophole by creating .url files that download and execute malicious scripts, bypassing Windows Defender SmartScreen warnings.
Microsoft addressed this vulnerability on November 14 2023. Still, its exploitation in the wild prompted the Cybersecurity and Infrastructure Security Agency (CISA) to include it in the Known Exploited Vulnerabilities (KEV) list on the same day.
Evidence suggests that since its discovery, various malware campaigns, including those distributing the Phemedrone Stealer payload, have incorporated this vulnerability into their attack chains. The attack vector primarily involves hosting malicious .url files on cloud services like Discord or FileTransfer.io, with attackers using URL shorteners to disguise these files.
Once the malicious .url file exploiting CVE-2023-36025 is executed, the malware employs defense evasion techniques, such as DLL sideloading and dynamic API resolving, to obfuscate its presence. The malware achieves persistence by creating scheduled tasks and utilizes an encrypted second-stage loader.
Read more on CVE-2023-36025 exploitation: BattleRoyal Cluster Signals DarkGate Surge
Second Stage Extraction and Exfiltration
Phemedrone Stealer’s second stage involves an open-source shellcode called Donut, enabling the execution of various file types in memory. The malware dynamically targets a broad range of applications and services. It then extracts sensitive information, including credentials, from browsers, crypto wallets, Discord, FileZilla, Steam and more.
The malware also employs an elaborate data exfiltration process, compressing and sending the harvested data through the Telegram API. It ensures data integrity by validating the Telegram API token and transmits a detailed system information report to the attackers.
Despite Microsoft issuing a patch for CVE-2023-36025, Trend Micro said threat actors persist in exploiting this vulnerability, emphasizing the need for organizations to update their Windows installations promptly.
“Organizations must make sure to update Microsoft Windows installations to prevent being exposed to the Microsoft Windows Defender SmartScreen Bypass,” reads the advisory.
“Public proof-of-concept exploit code exists on the web increasing the risk to organizations who have not yet updated to the latest patched version.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/stealers-target-windows-defender/