WINDOWS SMARTSCREEN FLAW EXPLOITED TO DROP PHEMEDRONE MALWARE

Summary from the TLDR InfoSec newsletter

Trend Micro reports that a Windows Defender SmartScreen vulnerability that was patched in the November 2023 Patch Tuesday is being actively exploited in a campaign to drop the Phemedrone malware. The campaign involves using a specially crafted internet shortcut file to bypass SmartScreen, download a control panel item file from the attacker’s C2, and execute the loader, which establishes persistence and runs the malware. The Phemedrone info-stealer targets browsers, crypto wallets, Discord credentials, files, FTP connection info, system info, Steam, and Telegram.