Hackers Exploit 6-Year-Old Microsoft Office Bug to Spread Malware

A recent phishing campaign has been observed using an old Microsoft Office vulnerability (CVE-2017-11882) to distribute a strain of malware called Agent Tesla. The attackers are sending decoy Excel documents attached to invoice-themed emails to trick potential targets into opening them and activating the exploitation of the vulnerability. Once a user downloads a malicious attachment and opens it, if their version of Microsoft Excel is vulnerable, the Excel file will initiate communication with a malicious destination and download additional files without requiring any further user interaction. The malware uses a steganographic evasion tactic to evade detection and has been abused to load Quasar RAT in the past. Agent Tesla is a.NET-based advanced keylogger and remote access trojan (RAT) that can log keystrokes, capture screenshots, and steal stored passwords from various web browsers. The threat actors are distributing spam emails with malicious attachments in hopes that users on vulnerable versions of Microsoft Excel will open the attachments and download them. Despite being old, the vulnerability remains effective due to its ability to execute code with user-level privileges.

Related reads

1. Hackers use six-year old Microsoft Office bug to spread Agent Tesla
2. An ancient Microsoft Excel vulnerability is being hijacked to spread malware
3. Attackers Exploit 6-Year-Old Microsoft Office Bug to Spread Spyware Attackers Exploit 6-Year-Old Microsoft Office Bug to Spread Spyware
4. Hackers Exploiting MS Excel Vulnerability to Spread Agent Tesla Malware - The Hacker News