Security News > 2024 > July > Windows MSHTML zero-day used in malware attacks for over a year
Haifei Li discovered that threat actors have been distributing Windows Internet Shortcut Files to spoof legitimate-looking files, such as PDFs, but that download and launch HTA files to install password-stealing malware.
An Internet Shortcut File is simply a text file that contains various configuration settings, such as what icon to show, what link to open when double-clicked, and other information.
When saved as a.url file and double-clicked, Windows will open the configured URL in the default web browser.
According to vulnerability researcher Will Dormann, opening a webpage in Internet Explorer offers additional benefits to threat actors, as there are fewer security warnings when downloading malicious files.
Check Point says that the threat actors are creating Internet Shortcut files with icon indexes to make them appear as links to a PDF file.
Check Point Research told BleepingComputer that allowing the HTA file to run would install the Atlantida Stealer malware password-stealing malware on the computer.
News URL
Related news
- Fortinet Warns of New Zero-Day Used in Attacks on Firewalls with Exposed Interfaces (source)
- FBI wipes Chinese PlugX malware from thousands of Windows PCs in America (source)
- WP3.XYZ malware attacks add rogue admins to 5,000+ WordPress sites (source)
- Microsoft fixes actively exploited Windows Hyper-V zero-day flaws (source)
- IPany VPN breached in supply-chain attack to push custom malware (source)
- SonicWall SMA appliances exploited in zero-day attacks (CVE-2025-23006) (source)
- SonicWall warns of SMA1000 RCE flaw exploited in zero-day attacks (source)
- MintsLoader Delivers StealC Malware and BOINC in Targeted Cyber Attacks (source)
- Google fixes Android kernel zero-day exploited in attacks (source)
- 7-Zip MotW bypass exploited in zero-day attacks against Ukraine (source)