Hackers bypass Windows SmartScreen flaw to launch malware

Cybercriminals are exploiting a vulnerability in Microsoft Defender, identified as CVE-2024-21412, to install malware without triggering the Windows SmartScreen protection. Despite a patch released by Microsoft in February, many Windows systems remain unpatched, making them susceptible to attacks. The vulnerability allows attackers to embed malicious URLs in .lnk files, enabling malware execution without detection. Fortinet's global security strategist, Aamir Lakhani, noted that attackers employ various methods to execute the malicious payload, including disguising executables and using .DLL sideloading. Phishing emails are the most common initial attack vector, often using deceptive lures related to healthcare, transportation, and taxes. Other tactics include exploiting Open Redirect links to lead victims to compromised servers. The malware typically provides backdoor access, credential theft, and remote keylogging capabilities. Users and administrators can mitigate the risk by updating Windows, which resolves the vulnerability, and by being cautious with email attachments from untrusted sources.