New Zero-day Exploit spotted in the wild

This report describes the CVE-2022-30190 (“Follina”) MSDT zero-day exploited via malicious Word documents that load remote HTML invoking the ms-msdt URI scheme to run PowerShell, decode and drop payloads (RAR/CAB) and execute a dropped binary; the advisory details reproduction, observed process chains, mitigation (disabling the ms-msdt protocol), and IOCs including hashes, a URL and an IP address.