Windows SmartScreen flaw exploited to drop Phemedrone malware

Phemedrone is an open-source information-stealer that leverages a Microsoft Defender SmartScreen vulnerability (CVE-2023-36025) to bypass Windows warnings via malicious .URL files hosted on trusted services; the dropper downloads a .cpl which launches a PowerShell-based DLL loader and uses DLL side-loading to execute payloads that harvest browser credentials, crypto wallets, Discord/Telegram/Steam data and system files, exfiltrating data (reported via Telegram); Trend Micro and BleepingComputer reported active exploitation and published IoCs, and the vulnerability was patched in November 2023.