The campaign primarily focused on compromising REDCap (Research Electronic Data Capture) servers, a widely used platform for managing clinical research databases and surveys. After gaining access, the attackers deployed custom malware called INFINITERED, harvested credentials, established persistence, and later abused enterprise email compliance rules to exfiltrate sensitive communications.

Campaign Overview

The operation demonstrates a sophisticated attack chain combining exploitation of public-facing applications, credential theft, malware deployment, persistence mechanisms, and stealthy data exfiltration.

Key Objectives

• Medical research intelligence
• Artificial Intelligence research
• Defense-related information
• Military health research Public health policy data

Researchers observed the activity from September 2023 through November 2025, indicating a highly patient and well-resourced espionage operation.

High-level attack flow used by UNC6508 to compromise research institutions and steal sensitive information.

Initial Access Through REDCap Servers

Why REDCap Was Targeted

REDCap is extensively used across:

• Hospitals
• Clinical research organizations
• Universities
• Government research programs
• Military health institutions

Because REDCap stores large volumes of research and patient-related information, it provides an attractive entry point for espionage-focused threat actors.

Researchers observed the attackers probing and exploiting vulnerable or legacy REDCap deployments exposed to the internet. Once access was obtained, they began internal reconnaissance and credential discovery activities.

Web Shell Deployment and Persistence

Following successful compromise, UNC6508 deployed a web shell identified as:

help.php

The web shell served multiple purposes:

• Persistent access
• File uploads
• Command execution
• Further malware deployment

This allowed the attackers to maintain long-term access even if passwords were changed or some security controls were implemented.

INFINITERED Malware Analysis

Three months after the initial intrusion, researchers observed deployment of a custom malware family called INFINITERED. This malware was specifically engineered to operate inside REDCap environments.

Modular architecture of INFINITERED malware used by UNC6508 to maintain persistence, harvest credentials, and execute commands within compromised REDCap environments.

Component 1 – Upgrade Interceptor

The malware monitors REDCap upgrade activities.

When administrators update REDCap, the malware automatically injects itself into newer versions, ensuring persistence across software upgrades

Component 2 – Credential Harvester

This module captures usernames and passwords entered into REDCap login pages.

Stolen credentials are stored within REDCap database tables and later retrieved by attackers.

Component 3 – Command-and-Control Backdoor

The third module acts as a fully functional backdoor.

Researchers found it could:

• Execute shell commands
• Upload files
• Download files
• Run SQL queries

Communication was hidden within HTTP cookie values, helping evade traditional detection mechanisms.

Abuse of Google Workspace for Data Exfiltration

One of the most interesting aspects of the campaign was the attackers’ use of legitimate Google Workspace functionality.

After obtaining administrative access, UNC6508 created a content compliance rule named:

Patroit

The rule automatically monitored emails containing specific keywords and forwarded matching messages to attacker-controlled Gmail accounts.

Attack Chain Breakdown

• External Reconnaissance
• Initial Compromise
• Persistence
• Privilege Escalation
• Intelligence Gathering

Potential Impact on Organizations

Organizations affected by this campaign could experience:

Research Theft

Loss of valuable intellectual property and scientific research.

Strategic Intelligence Exposure

Disclosure of defense and geopolitical information.

Credential Compromise

Unauthorized access to enterprise systems.

Regulatory Risks

Exposure of regulated healthcare and research data.

Alternative Indicators of Compromise (IOCs)

Security Recommendations

Upgrade REDCap Immediately

Remove legacy versions and apply the latest security updates.

Conduct Threat Hunting

Search for:

• help.php
• INFINITERED artifacts
• Unauthorized admin activity
• Credential harvesting indicators

The UNC6508 campaign highlights how modern nation-state threat actors are increasingly targeting research ecosystems to obtain strategic intelligence. By exploiting REDCap servers, deploying INFINITERED malware, and abusing legitimate cloud email features, the attackers maintained access for more than a year while collecting sensitive medical, defense, and technology research data. Organizations operating research platforms should prioritize patching, continuous monitoring, and proactive threat hunting to defend against similar espionage campaigns.

The post PRC-Linked Threat Actors Target REDCap Servers to Spy on U.S. Medical Research Organizations appeared first on First Hackers News.

Unlike traditional phishing attacks that immediately request credentials, Sniper Dz employs a multi-stage social engineering process designed to gradually build trust before redirecting users into malicious advertising and scam ecosystems. The campaign demonstrates how threat actors are increasingly combining social media platforms, legitimate web services, and browser features to maximize victim engagement.

Technical Analysis of the Campaign

Researchers found that the operation relies heavily on social engineering techniques rather than malware deployment. Victims are initially exposed to attractive Facebook advertisements promising prizes, discounts, giveaways, or exclusive offers.

The campaign then guides users through a series of seemingly legitimate web pages before ultimately triggering browser notification permissions and redirecting users into fraudulent content networks. By abusing trusted platforms and legitimate web services, the attackers are able to reduce suspicion and improve campaign effectiveness.

Sniper Dz Attack Flow

The attack follows a structured victim funnel designed to maximize conversion rates while minimizing detection.

Phase 1 – Social Media Lures

Attackers publish fraudulent advertisements and impersonation posts across social media platforms.

• Free gift offers
• Discount promotions
• Prize giveaways
• Mobile device rewards

Phase 2 – Legitimate-Looking Bridge Pages

Instead of immediately redirecting victims to malicious content, the campaign utilizes intermediary pages hosted on legitimate services.

• Link aggregation platforms
• Landing page builders
• Redirect services
• Social media profile pages

These bridge pages help bypass security filters and increase the perceived legitimacy of the campaign.

Simplified representation of the Sniper Dz victim funnel showing how users are guided from social media lures through trusted bridge pages before being exposed to browser notification abuse and scam content.

Phase 3 – Browser Notification Abuse

Once users reach the final stage, they are encouraged to allow browser notifications through deceptive prompts.

• Fake CAPTCHA pages
• “Click Allow to Continue”
• “Verify You’re Human”

After notification permissions are granted, attackers gain a persistent channel to deliver scam advertisements and fraudulent alerts directly to the victim’s browser.

Potential Risks to Users

• Financial Fraud
• Privacy Exposure
• Continuous Scam Exposure
• Credential Theft

Why Social Engineering Remains Effective

Modern scam campaigns increasingly rely on psychological manipulation rather than technical exploitation. By leveraging trusted platforms such as Facebook and legitimate web services, attackers can make fraudulent content appear authentic.

The use of multiple redirection stages also helps threat actors evade automated detection systems while increasing the likelihood that victims will complete the entire attack flow.

As users become more aware of traditional phishing techniques, attackers continue to evolve their tactics by combining social media abuse, browser notification exploitation, and deceptive marketing strategies.

Security Recommendations

• Verify Promotional Offers
• Review Browser Notifications
• Exercise Caution with Redirects
• Implement Security Awareness Training

The Sniper Dz campaign demonstrates how modern threat actors are leveraging social media impersonation, trusted bridge pages, and browser notification abuse to target users across the MENA region. Rather than relying on malware, the operation exploits user trust and social engineering tactics to drive victims toward fraudulent content, making awareness and browser security practices critical defenses against these evolving threats.

The post New Sniper Dz Scam Operation Exploits MENA Users with Fraudulent Facebook Offers appeared first on First Hackers News.

Researchers observed the campaign throughout 2025 and into 2026, with most targets including government agencies, diplomatic entities, and commercial organizations in Russia and Belarus. The operation combines phishing attacks, legacy vulnerabilities, custom malware, and stealthy persistence techniques to maintain long-term access inside victim environments.

The campaign demonstrates how attackers are increasingly blending legitimate administration tools with advanced malware techniques to avoid detection and maintain covert remote access.

Initial Access Through Phishing and Exploits

Cloud Atlas APT continues to rely heavily on phishing emails as its primary entry point. Attackers distribute ZIP archives containing malicious LNK shortcut files designed to silently execute PowerShell commands from attacker-controlled infrastructure.

At the same time, the threat actors also weaponize Microsoft Office documents exploiting the Equation Editor vulnerability, CVE-2018-0802, to download additional payloads onto infected systems.

Once executed, the PowerShell scripts establish persistence by saving a secondary script named fixed.ps1 in the Windows temporary directory and creating autorun entries through the Windows Registry.

To distract victims and reduce suspicion, the malware downloads a decoy archive, extracts a PDF document, and displays it on the screen while malicious activities continue in the background. During this stage, forensic traces are deleted and the primary payloads are launched.

VBCloud and PowerShower Backdoors

The fixed.ps1 script functions as a loader for two major malware components named VBCloud and PowerShower.

VBCloud File-Stealing Malware

VBCloud is mainly used for data theft. The malware deploys an encrypted payload named video.mds, which is decrypted in memory using RC4 encryption and executed through a Visual Basic Script (VBS) loader.

The malware searches for and exfiltrates sensitive files, including:

• DOC and DOCX documents
• PDF files
• XLS and spreadsheet data
• Other confidential business documents

Collected data is transmitted to attacker-controlled servers for further analysis and espionage purposes.

PowerShower for Reconnaissance and Lateral Movement

PowerShower focuses on reconnaissance, credential harvesting, and internal network movement. The malware gathers system and domain information, executes remote PowerShell commands, and supports lateral movement across enterprise environments.

Researchers observed the malware performing Kerberoasting attacks to extract Active Directory service account credentials. It also includes a credential harvesting module that abuses the fodhelper.exe UAC bypass technique to gain elevated privileges.

With administrative access, attackers can retrieve sensitive data from the SAM and SECURITY registry hives through Windows shadow copies.

Modification of termsrv.dll Enables Multiple RDP Sessions

A significant evolution in this campaign is the use of a PowerShell script called rdp_new.ps1, which directly modifies the Windows termsrv.dll library.

The termsrv.dll component controls Remote Desktop session management and normally prevents multiple simultaneous user logins. Cloud Atlas bypasses this restriction by taking ownership of the DLL file, patching specific byte sequences, and restarting the RDP service.

After modification, multiple concurrent RDP sessions become possible on the infected machine. This allows attackers to maintain hidden remote access without disconnecting legitimate users, significantly lowering the risk of detection.

This technique provides threat actors with stealthy persistence while blending malicious activity with normal administrator behavior.

Reverse SSH Tunnels and Stealth Persistence

To strengthen persistence and ensure continued remote access, Cloud Atlas deploys multiple tunneling and proxy mechanisms.

The attackers establish reverse SSH tunnels from compromised systems to remote servers under their control. These tunnels bypass inbound firewall restrictions and provide continuous access into internal networks.

The operation also uses:

• VBS scripts executed through PsExec
• Scheduled tasks for automatic tunnel recovery
• Modified file permissions to protect SSH keys
• Customized OpenSSH builds with altered cryptographic libraries
• RevSocks tunneling utilities written in Go
• Tor hidden services for anonymous RDP connectivity

These layered persistence mechanisms make incident response and remediation significantly more difficult.

PowerCloud Malware Uses Google Sheets for Data Exfiltration

Researchers also identified a newer tool called PowerCloud that collects administrative user information and exfiltrates the data to Google Sheets using Base64-encoded content.

The use of legitimate cloud services highlights Cloud Atlas’ growing focus on blending malicious traffic with normal enterprise activity, making traditional security monitoring more challenging.

Ongoing Threat to Government and Enterprise Networks

Telemetry linked to the campaign shows a strong focus on government, diplomatic, and high-value enterprise organizations, consistent with Cloud Atlas’ long-standing espionage objectives.

Although some infrastructure overlaps with activity associated with the Head Mare group have been observed, researchers noted that the malware families, techniques, and operational behavior remain distinct.

The continued use of publicly available tools such as SSH, Tor, PsExec, and RevSocks alongside advanced techniques like RDP manipulation demonstrates the group’s evolving capabilities and operational maturity.

Security teams are advised to closely monitor:

• Unauthorized changes to termsrv.dll
• Suspicious PowerShell execution
• Unexpected RDP configuration changes
• Reverse SSH connections
• Scheduled tasks linked to remote access tools
• Unusual use of cloud platforms for data transfers

The campaign highlights the increasing sophistication of modern cyber espionage operations and the importance of continuous monitoring for stealthy persistence mechanisms inside enterprise networks.

The post Cloud Atlas APT Uses Modified termsrv.dll to Enable Hidden RDP Access appeared first on First Hackers News.

Instead of obvious scripting activity, the attack blends into normal system behavior. This makes it harder for security teams to notice anything suspicious during the initial stages.

How the Attack Tricks Users

ClickFix still depends on social engineering. The attacker lures users to a fake website that looks like a CAPTCHA verification page. One such example is “healthybyhillary[.]com.”

The page guides the user through a simple-looking process:

• Press Win + R to open the Run dialog
• Paste a pre-copied command using Ctrl + V
• Hit Enter to execute it

To an average user, this feels like a normal verification step. But in reality, it triggers a malicious command that starts the infection process.

How It Evades Detection

Once executed, the attack uses rundll32.exe along with WebDAV to pull a malicious DLL from a remote server. Since rundll32.exe is a trusted Windows tool, this activity often appears legitimate.

A few key techniques make this variant harder to detect:

• Uses WebDAV to fetch remote files like a network share
• Executes DLL functions using ordinal numbers (#1) instead of readable names
• Avoids early use of PowerShell to bypass common detection rules
• Runs most of the attack in memory, leaving minimal traces on disk

After the initial stage, PowerShell is used quietly with flags like -NoP and -NonI, along with IEX (Invoke-Expression) to load additional payloads.

The final payload, known as SkimokKeep, includes advanced evasion methods:

• Resolves system functions using hashing instead of direct imports
• Checks for sandbox or VM environments before running
• Uses anti-debugging tricks like timing checks
• Injects code into legitimate processes such as browsers

Why This Matters

This shift is significant because many defenses are still focused on detecting script-based attacks. By abusing trusted Windows components and reducing visible activity, attackers get a much quieter entry point.

‍Follow Us on:Linkedin, Instagram, Facebook to get the latest security news!

What Security Teams Should Watch

To detect or prevent this attack, organizations should focus on unusual system behavior rather than just scripts:

• Monitor suspicious use of rundll32.exe, especially with WebDAV-related arguments
• Enable command-line logging for system binaries (LOLBins)
• Restrict or monitor WebDAV traffic over port 80
• Block known malicious IPs and domains linked to the campaign
• Educate users about fake CAPTCHA pages and ClickFix tricks

This variant shows how attackers continue to adapt. The real risk isn’t just the malware itself—it’s how easily users can be convinced to launch it.

Block Known Malicious Infrastructure

Security teams should proactively block known indicators linked to this campaign to reduce exposure:

• 178.16.53[.]137
• 141.98.234[.]27
• 46.149.73[.]60
• 91.219.23[.]245

Suspicious domains to watch or block:

• mer-forgea.sightup[.]in[.]net
• data-x7-sync.neurosync[.]in[.]net

You can place this section right after the “What Security Teams Should Watch” section so it flows naturally as an action step.

The post ClickFix Variant Bypasses Detection Using Rundll32 & WebDAV appeared first on First Hackers News.

This update ensures that only drivers verified through Microsoft’s Windows Hardware Compatibility Program (WHCP) are allowed to run automatically. By enforcing stricter validation, Microsoft is reducing the risk of attackers using malicious drivers to gain deep, kernel-level access to systems.

This enhancement is crucial for maintaining high standards of Windows kernel driver security across all devices.

Kernel drivers operate at the core of the operating system, so any weakness in how they are signed or validated can be exploited. By removing support for legacy signing methods, Microsoft is closing a long-standing security gap.

Removal of Cross-Signed Drivers and Security Impact

The older cross-signing model allowed third-party certificate authorities to approve drivers without strict validation from Microsoft. While this approach helped with compatibility in the past, it also introduced security risks.

Attackers have historically abused this model by stealing signing keys and using them to install rootkits and other advanced malware. Even though Microsoft deprecated cross-signing in 2021, older certificates were still trusted by Windows systems until now.

With this update, that trust is fully removed. Drivers must now go through a stricter approval process that includes:

• Identity verification of the vendor
• Security and compatibility testing
• Malware scanning before certification

This significantly reduces the chances of malicious drivers being loaded into the Windows kernel.

Deployment Approach and Enterprise Considerations

To avoid disruptions, Microsoft is rolling out this change in stages. Initially, the system will monitor and evaluate driver activity before enforcing the block. This allows organizations to identify compatibility issues early.

Additionally, Microsoft will maintain an allow list for widely used legacy drivers to prevent system failures. If unsupported drivers are detected, enforcement may be delayed until the system is stable.

For enterprise environments, there is still controlled flexibility. Organizations that rely on custom kernel drivers can allow them using Application Control for Business policies. These policies must be securely signed and tied to UEFI Secure Boot, ensuring only trusted internal drivers are permitted.

Overall, this update marks a significant step toward strengthening Windows security by limiting kernel-level attack vectors and enforcing modern driver validation standards.

‍Follow Us on:Linkedin, Instagram, Facebook to get the latest security news!

The post Windows 11 Blocks Untrusted Kernel Drivers to Improve Security appeared first on First Hackers News.

The project is part of a wider Endpoint Detection and Response effort called Sanctum. It shows how defenders can use Windows Minifilters to spot and interrupt malicious file encryption before user data is damaged.

How the Detection Method Works

At the center of this approach is a Windows feature known as a file system filter driver. This driver operates between user applications and the storage system, meaning every file operation — creating, modifying, or renaming files — passes through it.

Researcher 0xflux describes this layer as a control point. Because all file activity flows through it, the system can monitor behavior in real time and step in when something suspicious happens.

Although the developer initially planned to build the driver in Rust, the lack of proper filter driver support led to the project being written in C instead.

What Signals Indicate Ransomware

The Sanctum driver registers system callbacks so it gets notified when certain file actions occur. The proof-of-concept focuses on two important Windows file events.

One event tracks when programs request access to files with write or delete permissions. A process rapidly opening many files with these permissions can signal the start of mass encryption.

The second event is more central to this PoC. It triggers when file information changes, such as when a file is renamed. Ransomware often renames files after encryption, adding a new extension to mark them as locked.

In this demo, the driver watches for a specific extension tied to a known LockBit variant.

How the System Identifies the Attacker

When a rename event occurs, the driver uses Windows APIs to read the full file name and compare the new extension with known ransomware patterns.

If a match appears, the system does more than log the event. It also determines which process made the change. Using internal functions, it retrieves the process ID and the program name responsible. This gives defenders precise visibility into which application is behaving maliciously.

Right now, the tool mainly records suspicious activity, acting as a detailed monitoring system. However, future versions could go further.

The researcher suggests adding real-time entropy analysis to detect encryption as it happens. Another potential feature is freezing or terminating the threads of a malicious process immediately after detection.

This project shows how moving defenses deeper into the Windows kernel can provide faster response and greater visibility than traditional antivirus solutions that operate at higher system levels.

The post Using Windows Minifilters to Identify Ransomware Activity appeared first on First Hackers News.

Although classified as a preview update, it brings major improvements to how Windows safeguards core file structures. The changes address increasing security concerns related to privilege escalation and direct manipulation of protected system resources.

Improved System File Security

The update introduces tighter controls over Windows system directories and essential files. Access validation has been reinforced so that only properly authorized processes can read or modify protected areas of the operating system.

This improvement targets a common technique used in both advanced and widespread attacks, where adversaries attempt to alter system files to gain higher privileges or establish hidden persistence.

Researchers have observed a rise in attacks involving direct file system abuse. The new mechanisms in KB5074105 apply layered permission checks, ensuring that interactions with critical files are limited to trusted system components. This layered validation reduces the likelihood of successful privilege escalation attempts.

Servicing Stack Enhancement

Alongside these protections, Microsoft also released KB5074104, which updates the Windows servicing stack. Since this component handles how updates are installed, strengthening it improves the reliability and security of future patch deployments.

For organizations managing large numbers of devices, this means more stable update cycles and a lower risk of systems missing critical patches due to installation failures.

AI Component Improvements

The update also refreshes several AI-powered modules that support intelligent features within Windows 11. These enhancements focus on better performance and improved security for on-device AI processing.

Updated AI components include:

• Image Search
• Content Extraction
• Semantic Analysis
• Settings Model

These modules now operate more efficiently while maintaining strong data protection standards.

Deployment Approach and Recommendations

Microsoft is releasing KB5074105 in stages to reduce compatibility risks. Devices receive the update gradually before wider availability.

Security and IT teams are advised to test the update in controlled environments before organization-wide rollout, particularly in sensitive networks. Monitoring update health and coordinating patch management strategies will help ensure smooth adoption.

With attackers increasingly targeting the operating system core, the enhanced file protection features in KB5074105 provide an important defense layer against evolving threats.

The post Windows 11 Strengthens Protection of System Files appeared first on First Hackers News.

Microsoft is investigating serious problems linked to its January 2026 security update for Windows 11 after reports of systems failing to start correctly. The update, which was meant to strengthen security, has instead left some users unable to boot their devices.

The issue is tied to update KB5074109, released for Windows 11 versions 25H2 and 24H2. Shortly after installation, affected systems began showing critical startup errors, including boot loops and black screens. In some cases, devices display an UNMOUNTABLE_BOOT_VOLUME error and never reach the login screen.

Microsoft has acknowledged the problem and confirmed receiving a limited number of reports where devices cannot complete startup. So far, the issue appears to affect physical machines only, with virtual environments remaining unaffected. For impacted users, access to the operating system is often lost entirely, requiring recovery tools to remove the update.

Even on systems that manage to boot, the update has caused widespread stability concerns. Users report random freezes, display issues, and conflicts with graphics drivers, particularly during GPU-intensive tasks. Some applications become unresponsive without triggering a crash or error message, leaving systems stuck until a forced restart.

The update has also disrupted productivity and enterprise services. Microsoft confirmed that credential prompts for certain cloud and remote desktop services were broken, temporarily preventing users from connecting. Outlook Classic users have also reported freezes and sync problems after startup.

What users should do now

• Uninstall the latest update using the Windows Recovery Environment if the system won’t boot
• Roll back KB5074109 or pause updates on unstable systems
• Delay installing the update until Microsoft releases a permanent fix

Microsoft continues to investigate the root cause of these failures. Until a comprehensive resolution is available, users and administrators are advised to approach the January update with caution, especially on production systems.

The post Windows 11 January Update Triggers Serious Boot Issues appeared first on First Hackers News.

While the issue does not enable full system takeover, it weakens safeguards designed to protect users from untrusted content, making it particularly relevant in post-compromise or insider attack scenarios.

How the Vulnerability Works

The flaw lies in how Windows Remote Assistance handles specially crafted files used to start or manage assistance sessions. In some cases, these files are processed in a way that skips normal security checks, allowing them to appear more trusted than they actually are.

As a result, protections tied to Mark of the Web (MOTW)—such as warning prompts, SmartScreen checks, and certain script or macro restrictions—may not be enforced.

This means content that originated from the internet could be opened locally without the usual defenses, increasing the risk of stealthy data access or follow-on attacks.

Exploitation requires user interaction, typically by convincing a victim to open a malicious file delivered through email, messaging platforms, or a web download.

Impact, Affected Systems, and Mitigation

• Impact: Enables attackers to bypass Mark of the Web protections, potentially allowing sensitive data access or stealthy follow-on attacks without triggering expected security warnings.
• Affected Systems: Supported versions of Windows 10, Windows 11, and Windows Server, including both client and enterprise deployments.
• Mitigation: Microsoft has addressed the issue in the January 2026 Patch Tuesday updates. Organizations should apply the updates as soon as possible. Until patching is complete, administrators are advised to restrict Windows Remote Assistance usage, enhance email and web filtering controls, and remind users to avoid opening unsolicited assistance files or attachments.

Applying the latest security updates restores proper protection checks and significantly reduces the risk of this bypass technique being exploited.

‍Follow Us on: Linkedin, Instagram, Facebook to get the latest security news!

The post Security Bypass Issue Found in Windows Remote Assistance appeared first on First Hackers News.

Rated 9.8 on the CVSS scale, this vulnerability is extremely dangerous because it can be exploited without any user interaction.

All about the vulnerability

The flaw was discovered in May 2025 and patched by Microsoft on August 12, 2025. It comes from an untrusted pointer dereference in the windowscodecs.dll file, which is responsible for core image processing.

Attackers can hide a malicious JPEG inside common files such as Microsoft Office documents. When the file is opened or even previewed, the system can be silently compromised.

This issue shows the risks that still exist in older graphics-handling components, where something as simple as decoding an image can lead to a full system takeover. Since Windows is used on billions of devices, unpatched machines remain highly vulnerable to phishing attacks and drive-by downloads.

Zscaler ThreatLabz discovered the vulnerability through targeted fuzzing of the Windows Imaging Component, focusing on how JPEG images are encoded and decoded within windowscodecs.dll.

The entry point for exploitation is in the GpReadOnlyMemoryStream::InitFile function. By manipulating buffer sizes, attackers can take control of memory snapshots during file mapping.

Fuzzing tests uncovered a crash caused by an uninitialized pointer at jpeg_finish_compress+0xcc, allowing user-controlled data to be accessed through heap spraying.

Debugging with WinDbg showed stack traces involving functions like CJpegTurboFrameEncode::HrWriteSource and CFrameEncodeBase::WriteSource, confirming that the flaw lies in JPEG metadata handling.

This uninitialized resource bug allows attackers to run code remotely without needing special permissions. Microsoft confirmed that the issue affects automatic image rendering in applications that rely on the Windows Graphics Component.

Affected Versions and Patch Information

Zscaler’s proof-of-concept shows how attackers can manipulate memory by using an app that allocates, frees, and processes Base64-encoded JPEG files, eventually gaining control over the instruction pointer.

There are no known real-world attacks yet, but the low skill needed and the broad attack surface make this vulnerability attractive to ransomware groups and espionage actors. On 32-bit systems, the risk is even higher because Control Flow Guard is disabled by default.

Users should install the August 2025 Patch Tuesday updates as soon as possible, especially on critical systems. It also helps to disable automatic image previews in email clients and restrict untrusted files to sandboxed environments. Zscaler has already deployed cloud-level defenses to detect and block any exploit attempts.

This case highlights the risks of outdated graphics libraries in enterprise environments, where JPEG files are used everywhere. Although no active exploitation has been observed, quick patching and cautious file handling remain the best protection against these image-based attacks.

‍Follow Us on: Linkedin, Instagram, Facebook to get the latest security news!

The post Windows Graphics Vulnerability Opens the Door to System Hijack with a Single Image appeared first on First Hackers News.