Week of January 8, 2024

The Phemedrone Stealer campaign actively exploits CVE-2023-36025, a Windows Defender SmartScreen bypass vulnerability, to deliver malware. Attackers use crafted .url files to evade SmartScreen warnings and execute malicious .cpl files, leading to data theft from browsers, crypto wallets, and messaging apps. The vulnerability was patched in November 2023 but remains exploited in the wild.

A vulnerability in Cortex EDR allows local attackers to access sensitive log files before they are encrypted by the TFS process. During support file generation, temporary unencrypted copies of files like trapsd.log, agset.json, and defaultprofile.json are briefly stored in C:\ProgramData\Cyvera\LocalSystem\, enabling data theft. This bypasses the intended encryption and password protection of the generated support ZIP file.

CVE-2024-0213 is a buffer overflow vulnerability in Trellix Agent for Linux and macOS prior to version 5.8.1. A local attacker can exploit improper input validation to escalate privileges to root or cause denial of service. The flaw also risks disabling event reporting to ePO, undermining endpoint security monitoring.