Weaponized LDAP Exploit Deploys Information-Stealing Malware

Cybercriminals are distributing malicious fake proof-of-concept 'LDAPNightmare' exploits for CVE-2024-49112/49113 by forking legitimate repositories and replacing Python source files with a packed executable (poc.exe). When executed, the binary drops PowerShell scripts that establish persistence via a scheduled task, retrieve additional scripts from Pastebin, collect extensive system data, compress the information, and exfiltrate it (including the victim's public IP) to an external FTP server; defenders are advised to obtain code from trusted sources, review commit history, and verify repository owners.