Malicious GitHub PoC Exploit Spreads Infostealer Malware

A malicious GitHub repository disguises a proof-of-concept (PoC) exploit for CVE-2024-49113, also known as “LDAPNightmare,” delivering infostealer malware that sends sensitive data to an external FTP server. Disguised as a legitimate PoC, the exploit tricks users into executing malware.

While using fake PoC exploits is not a new tactic, Trend Micro‘s discovery shows that cybercriminals continue to deceive unsuspecting users. This malicious repository appears to be a fork of SafeBreach Labs’ original PoC for CVE-2024-49113, which was released on January 1, 2025.

CVE-2024-49113 is one of two vulnerabilities affecting the Windows Lightweight Directory Access Protocol (LDAP), which was patched by Microsoft during December 2024’s Patch Tuesday. The other vulnerability, CVE-2024-49112, is a critical remote code execution (RCE) flaw.

SafeBreach’s blog post initially mislabeled the vulnerability as CVE-2024-49112, which sparked interest in LDAPNightmare, potentially attracting threat actors looking to exploit this buzz.

The PoC from the malicious repository contains a UPX-packed executable, ‘poc.exe,’ which drops a PowerShell script in the victim’s %Temp% folder upon execution. The script sets up a scheduled job that runs an encoded script,

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.