Booby-trapped Word documents in the wild exploit critical Microsoft 0day

[dlevere]

Microsoft knew about a Word bug that put millions of computers at risk but waited 6 months to fix it

[xirtamehtsitahw]

I hardly ever get emails anyway, and I know what a suspicious one looks like. As in, one from no one I've ever received an email before, or am expecting one from.

[dlevere]

Critical Word 0-day is only 1 of 3 Microsoft bugs under attack

[soprano1]

Meh. Call me when they create something that works by simply opening an e-mail. Until then, Common Sense works.

[dlevere]

There's currently no patch for the bug, which affects most or all versions of Word.

There's a new zero day attack in the wild that's surreptitiously installing malware on fully-patched computers. It does so by exploiting a vulnerability in most or all versions of Microsoft Word.

The attack starts with an e-mail that attaches a malicious Word document, according to a blog post published Saturday by researchers from security firm FireEye. Once opened, exploit code concealed inside the document connects to an attacker controlled server.

It downloads a malicious HTML application file that's disguised to look like a document created in Microsoft's Rich Text Format. Behind the scenes, the .hta file downloads additional payloads from "different well-known malware families."

https://arstechnica.com/security/201...icrosoft-0day/