This nasty Internet Explorer zero-day is now launching real-world attacks

security threat
(Image credit: Shutterstock.com)

Threat actors are exploiting a zero-day vulnerability in a critical Internet Explorer (IE) component to target Microsoft Office users, warn cybersecurity researchers.

The attack was detected by researchers at the exploit detection service, Expmon, who brought it to the attention of Microsoft, which has now published a security advisory on the ongoing threat.

“Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents,” Microsoft warns through its advisory.

TechRadar needs you!

We're looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won't take more than 60 seconds of your time, and we'd hugely appreciate if you'd share your experiences with us.

>> Click here to start the survey in a new window <<

The vulnerability, tracked as CVE-2021-40444, impacts IE’s browser engine Trident, also known as MSHTML, which also helps render browser-based content inside Microsoft Office documents.

No patch yet

According to Expmon, the vulnerability impacts the latest versions of both the offline and online instances of Microsoft Office. 

“We have reproduced the attack on the latest Office 2019 / Office 365 on Windows 10 (typical user environment), for all affected versions please read the Microsoft Security Advisory. The exploit uses logical flaws so the exploitation is perfectly reliable (& dangerous),” shared Expmon.

Talking about the exploitation mechanism, Microsoft says that the vulnerability is exploited via malicious ActiveX controls embedded in Office documents. However, the company hasn’t revealed any details about the nature of the zero-day, nor has it commented on the on-going attack.

This isn’t surprising since it hasn’t yet patched the zero-day, which might be addressed either during an upcoming Patch Tuesday, or through an out-of-cycle update. 

In the meantime, Microsoft suggests users to disable the rendering of ActiveX content in Office documents, while Expmon urges users to avoid opening documents from unknown sources.

Mayank Sharma

With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’s TechRadar Pro’s expert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.

Read more
Outlook
Dangerous Microsoft Outlook flaw could let hackers send out malware via email
Representational image depecting cybersecurity protection
Hackers are breaking SonicWall products to target business networks
The best free firewall
Microsoft fixes Power Pages security flaw, tells users to be on their guard
Flag of the People&#039;s Republic of China overlaid with a technological network of wires and circuits.
One of the biggest flaws exploited by Salt Typhoon hackers has had a patch available for years
Representational image of a cybercriminal
Microsoft just patched a host of worrying security issues, so update now
An option to add Ambient Music buttons to the iOS 18.4 Control Center.
Apple fixes dangerous zero-day used in attacks against iPhones and iPads
Latest in Security
Data Breach
Thousands of healthcare records exposed online, including private patient information
China
Juniper patches security flaws which could have let hackers take over your router
Representational image depecting cybersecurity protection
GitLab has patched a host of worrying security issues
Ai tech, businessman show virtual graphic Global Internet connect Chatgpt Chat with AI, Artificial Intelligence.
AI agents can be hijacked to write and send phishing attacks
China
Volt Typhoon threat group had access to American utility networks for the best part of a year
Abstract image of cyber security in action.
MassJacker malware targets those looking for pirated software
Latest in News
Super Mario Odyssey
ChatGPT is the ultimate gaming tool - here's 4 ways you can use AI to help with your next playthrough
Ray-Ban smart glasses with the Cpperni logo, an LED array, and a MacBook Air with M4 next to ecah other.
ICYMI: the week's 7 biggest tech stories from Twitter's massive outage to iRobot's impressive new Roombas
Brad Pitt looks over his right shoulder with &#039;F1&#039; written behind him
Apple Original Films will take you behind-the-scenes of a racing cockpit in this new thrilling F1 movie trailer
AI writer
Coding AI tells developer to write it himself
Reacher looking down at another character from the Prime Video TV series Reacher
Reacher season 3 becomes Prime Video’s biggest returning show thanks to Hollywood’s biggest heavyweight
Finger Presses Orange Button Domain Name Registration on Black Keyboard Background. Closeup View
I visited the world’s first registered .com domain – and you won’t believe what it’s offering today