{"uuid": "40ef6b49-bbcf-4ba9-a820-523b336cfae1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/32652", "content": "Black Hat Ethical Hacking\nHackers exploit Microsoft MSHTML bug to steal Google, Instagram creds\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hackers exploit Microsoft MSHTML bug to steal Google, Instagram credsPost Views: 118 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/BF2.gif \nReading Time: 1 Minute\nA newly discovered Iranian threat actor is stealing Google and Instagram credentials belonging to Farsi-speaking targets worldwide using a new PowerShell-based stealer dubbed PowerShortShell by security researchers at SafeBreach Labs.\nThe info stealer is also used for Telegram surveillance and collecting system information from compromised devices that get sent to attacker-controlled servers together with the stolen credentials.\n\nAs SafeBreach Labs discovered, the attacks (publicly reported in September\u00a0on Twitter by the Shadow Chaser Group) started in July as spear-phishing emails.\n\nThey target Windows users with malicious Winword attachments that exploit a Microsoft MSHTML remote code execution (RCE) bug tracked as CVE-2021-40444.\n\nThe PowerShortShell stealer payload is executed by a DLL downloaded on compromised systems. Once launched, the PowerShell script starts collecting data and screen snapshots, exfiltrating it to the attacker\u2019s command-and-control server.\n\n\u201cAlmost half of the victims are located in the United States. Based on the Microsoft Word document content \u2013 which blames Iran\u2019s leader for the \u2018Corona massacre\u2019 and the nature of the collected data, we assume that the victims might be Iranians who live abroad and might be seen as a threat to Iran\u2019s Islamic regime,\u201d said\u00a0Tomer Bar, Director of Security Research at SafeBreach Labs.\nSee Also: Complete Offensive Security and Ethical Hacking Course \u201cThe adversary might be tied to Iran\u2019s Islamic regime since the Telegram surveillance usage is typical of Iran\u2019s threat actors like Infy, Ferocious Kitten, and Rampant Kitten.\u201d\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/Victim_heat_map.png \n<figcaptionVictims heat map (SafeBreach Labs) \nThe CVE-2021-40444 RCE bug impacting IE\u2019s MSTHML rendering engine has been exploited in the wild as a zero-day starting with August 18, more than two weeks before Microsoft issued a security advisory with a partial workaround, and three weeks before a patch was released.\n\nMost recently, it was exploited in conjunction with malicious advertisements by the Magniber ransomware gang\u00a0to infect targets with malware and encrypt their devices. Microsoft also said multiple threat actors, including ransomware affiliates, targeted\u00a0this\u00a0Windows MSHTML\u00a0RCE bug using\u00a0maliciously crafted Office documents delivered via phishing attacks.\nSee Also: New Windows zero-day with public exploit lets you become an admin These attacks abused the CVE-2021-40444 flaw \u201cas part of an initial access campaign that distributed custom Cobalt Strike Beacon loaders.\u201d\n\nThe deployed beacons communicated with malicious infrastructure connected with several cybercrime campaigns, including but not limited to human-operated ransomware.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/CVE-2021-40444-attack-chain%20.png \n<figcaptionCVE-2021-40444 attack-chain (Microsoft)\u200b\u200b\u200b\u200b \nIt\u2019s not surprising that more and more attackers are using CVE-2021-40444 exploits since threat actors started sharing tutorials and proof-of-concept exploits on hacking forums even before the bug was patched.\n\nThis likely allowed other threat actors and groups to start exploiting the security flaw in their own attacks.\nSee Also: Offensive Security Tools: Awesome Bug Bounty Tools The information shared online is simple to follow an[...]", "creation_timestamp": "2026-09-01T20:02:08.390994Z"}