CVE-2024-21412

CVE-2024-21412 is a security feature bypass vulnerability in the Microsoft Windows Internet Shortcut SmartScreen. The flaw, which was exploited as a zero-day, allows attackers to bypass the SmartScreen feature that typically warns users about running unrecognized apps and files from the internet. This vulnerability was actively exploited by two groups, one of them being the financially motivated advanced group Water Hydra (also known as DarkCasino), who targeted financial market traders. This vulnerability has been exploited through social engineering methods such as email and direct messages, requiring some form of user interaction for successful exploitation. The flaw was initially discovered by researchers who also uncovered a similar zero-day bug (CVE-2024-21412) used in a DarkGate campaign impersonating popular brands like Apple iTunes. This similarity indicates a pattern of exploiting vulnerabilities within the SmartScreen feature, making it a critical area for future security enhancements. Microsoft addressed this issue with a patch, CVE-2024-29988, credited to the same researchers who initially disclosed the flaw. However, given the active exploitation of these vulnerabilities and their potential impact on users, it is essential for all users to apply the necessary patches promptly and remain vigilant against social engineering attempts. Furthermore, businesses and individuals should ensure they have robust security measures in place to protect against such threats.