CISA warns of Windows flaw used in infostealer malware attacks

CISA ordered U.S. federal agencies to patch a Microsoft MSHTML zero-day (CVE-2024-43461) actively exploited by the Void Banshee APT in an exploit chain that delivered HTA files disguised as PDFs (using encoded braille whitespace) to deploy the Atlantida information-stealer; Microsoft confirmed pre-patch exploitation and advised applying both July and September security updates.