Cybercriminals Exploit Microsoft Word Vulnerabilities to Deploy LokiBot Malware

Microsoft Word documents exploiting known remote code execution flaws are being used as phishing lures to drop malware called LokiBot on compromised systems.

“LokiBot, also known as Loki PWS, has been a well-known information-stealing Trojan active since 2015,” Fortinet FortiGuard Labs researcher Cara Lin said. “It primarily targets Windows systems and aims to gather sensitive information from infected machines.”

The cybersecurity company, which spotted the campaign in May 2023, said the attacks take advantage of CVE-2021-40444 and CVE-2022-30190 (aka Follina) to achieve code execution.

images from Hacker News