South Korean hackers exploited WPS Office zero-day to deploy malware

ESET researchers uncovered that APT-C-60 exploited a zero-day in WPS Office (CVE-2024-7262) via malicious MHTML documents that invoke the ksoqing:// protocol to load a malicious DLL and deploy the SpyGlace backdoor against East Asian targets; a subsequent incomplete patch introduced CVE-2024-7263. Users are advised to update to WPS Office 12.2.0.17119 and consult published IoCs.