Windows MSHTML zero-day used in malware attacks for over a year

Microsoft patched CVE-2024-38112, a high-severity MHTML spoofing zero-day that threat actors abused to invoke Internet Explorer via crafted .url files and the mhtml: URI; IE would download HTA files disguised as PDFs (using Unicode padding) which, when executed, installed the Atlantida stealer to harvest credentials, cookies, wallets, and other sensitive data. Check Point found samples dating back to January 2023, and Microsoft mitigated the issue in July 2024 by unregistering the mhtml: handler so Edge handles the content.