Void Banshee’s Zero-Day Assault on Windows Users via Internet Explorer

Threat actors are exploiting the CVE-2024-38112 vulnerability by abusing the mhtml protocol handler to lure Windows users into remote code execution. They use Windows Internet Shortcut files (.url) to trigger the retired Internet Explorer (IE) to visit attacker-controlled URLs. The APT group Void Banshee has been found capitalizing on this flaw, deploying the Atlantida stealer for information theft and financial gains.