Stealth Falcon APT Exploits Microsoft RCE Zero-Day in Mideast

Stealth Falcon (aka FruityArmor) is exploiting a Microsoft WEBDAV zero-day (CVE-2025-33053, CVSS 8.8) via spear-phishing links to achieve one-click RCE and deploy the Horus Agent backdoor that integrates with Mythic C2; Microsoft addressed this and 65 other vulnerabilities in its June 2025 patch release and organizations—particularly defense and government entities in the Middle East and Africa—are urged to prioritize updates and remediation.