There is a report of a zero-day vulnerability in Microsoft Word discovered over the weekend, which is being used by scammers to try and steal your banking details.
The discovery was made by cyber security firm Proofpoint, who say they came into this discovery from an email campaign targeting the bug that was aimed to spread Dridex malware. This malware is designed to infect the targeted computer and start snooping around for banking login information.
This is not the first time the cybersecurity world is encountering the Dridex malware. Back in 2015, it was reported to be responsible for cyberattacks that made away with £20m from bank accounts in Britain.
This flaw being exploited by the Dridex malware is apparently available in many versions of the Microsoft Word for Windows. The Dridex malware is just one of the many possible malware that could exploit the security hole in MS Word app.
A scam email has been discovered to be distributing Microsoft Word RTF (Rich Text Format) documents to computers. The RTF documents contain the Dridex malware within them.
“During our testing (for example on Office 2010) the vulnerable system was fully exploited,” said researchers from Proofpoint who discovered this zero-day vulnerability.
In response to this revelation to their product, Microsoft representative in a statement said, “We plan to address this through an update on Tuesday, April 11, and customers who have updates enabled will be protected automatically.
Meanwhile, we encourage customers to practice safe computing habits online, including exercising caution before opening unknown files and not downloading content from untrusted sources to avoid this type of issue.”
Proofpoint is urging MS Word users to install the security update quickly.
“Because of the widespread effectiveness and rapid weaponization of this exploit, it is critical that users and organization apply the patch as soon as it becomes available.”
