{"uuid": "dc1bc458-bb7d-47f0-ac41-5ecf75fabd00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23249", "content": "ility.\n\nWith these bypasses and additional use cases, CVE-2021-40444 has become even more severe than initially thought. How CVE-2021-40444 is currently used in attacksWhile we do not have the actual phishing emails used in the attacks, Beaumont has analyzed the malicious Word document to understand better how the exploit works.\nLooks like this has been in the wild for a week or more.  Uses the daft as F feature that allows Word to load a template from internet, that spawns IE and then trusts JS and ActiveX controls, then uses ../.. (yes it's 1999) to spawn .cpl file https://t.co/mOvaN9YLj6 pic.twitter.com/xLf2jVWyY5\n\n\u2014 Kevin Beaumont (@GossiTheDog) September 8, 2021\nSee Also: Offensive Security Tool: Pegasus Spyware \u2013 Decompiled One of the known malicious Word attachments used in the attacks is named \u2018A Letter before court 4.docx\u2019 [VirusTotal] and claims to be a letter from an attorney.\n\nSince the file was downloaded from the Internet, it will be tagged with the \u2018Mark of the Web\u2019 and opened in Protected View, as shown below.\nhttps://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2021-40444/malicious-word-document.jpg \nSee Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 Hackerhttps://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2021-40444/side_html-file.jpg \n(Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Malware-90x90.jpg Microsoft shares temp fix for ongoing Office 365 zero-day attacks1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Jenkins-90x90.jpg Jenkins project\u2019s Confluence server hacked to mine Monero2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/unnamed-e1630998483665-90x90.jpg Critical Auth Bypass Bug Affect NETGEAR Smart Switches3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/loyalty-card-90x90.jpg Brute-Force Attacks Target Inboxes for Gift Card Data4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Braktooth-New-Bluetooth-gaps-threaten-countless-devices-1024x576-1-90x90.jpg Bluetooth Bugs Open Billions of Devices to DoS, Code Execution1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploa[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:24.920103Z"}