Malware Authors Seem Intent on Weaponizing Windows SettingContent-ms Files (bleepingcomputer.com)

An anonymous reader shares a report: Malware authors are frantically trying to weaponize a new infection vector that was revealed at the start of June. The trick relies on using Windows Settings (.SettingContent-ms) shortcut files in order to achieve code execution on Windows 10 PCs. Ever since SpecterOps security researcher Matt Nelson published his research on the matter three weeks ago, malware authors have been playing around with proof-of-concept code in attempts of crafting an exploit that can deploy weaponized malware on a victim's system. With each passing day, more and more exploits are being uploaded on VirusTotal.

Comments

Vulnerability description

[Anonymous Coward]

In case this is news to you and you're wondering about this vulnerability, here's a description.
Microsoft has introduced a new file format (extension: .SettingContent-ms) to link to settings pages. In this format a <DeepLink> tag contains the application to run in order to display the settings page. So like program information files (.pif), shortcuts (.lnk), batch files (.bat) and so on these should be treated as executable programs, because these files can do anything the author wishes. Just specify "%WINDIR%\System32\cmd.exe /c ..." as the command line.
But apparently Microsoft itself didn't appropriately mark the new shortcut file type as executable and because it's a new file type, third-party vendors of things like anti-virus software, web browsers and e-mail clients haven't caught up yet either.