Malware & Threats

Infostealer Masquerades as PoC Code Targeting Recent LDAP Vulnerability

A fake proof-of-concept (PoC) exploit for a recent LDAP vulnerability distributes information stealer malware.

Ionut Arghire

Published

January 13, 2025

A fake proof-of-concept (PoC) exploit for a recent LDAP vulnerability distributes information stealer malware.

Threat actors are distributing information stealer malware masquerading as proof-of-concept (PoC) exploit code targeting a recent Windows Lightweight Directory Access Protocol (LDAP) vulnerability.

Tracked as CVE-2024-49113 (CVSS score of 7.5) and leading to denial-of-service (DoS), the security defect was addressed on December 10 along with over 70 flaws, including a critical LDAP bug (CVE-2024-49112) that could lead to remote code execution (RCE).

Less than a month after patches were rolled out for the two issues, SafeBreach published PoC code targeting CVE-2024-49113, saying that it should be considered as important as the RCE flaw.

According to SafeBreach, which refers to CVE-2024-49113 as LDAPNightmare, the vulnerability can be abused to crash any unpatched Windows server, even those that are not Domain Controllers, if there is an internet-accessible DNS server.

Now, Trend Micro warns of a fake PoC exploit that lures security researchers into executing information stealer malware on their systems.

“Although the tactic of using PoC lures as vehicle for malware delivery is not new, this attack still poses significant concerns, especially since it capitalizes on a trending issue that could potentially affect a larger number of victims,” Trend Micro notes.

Advertisement. Scroll to continue reading.

The PoC is distributed via a repository forked from the original and replaces the original Python files with an executable packed using UPX.

When executed, the fake PoC drops a PowerShell script in the system’s temporary folder. The script creates a scheduled task that executes an encoded script designed to download another script from Pastebin.

The second script collects system information such as process list, directory list, IP addresses, network adapter information, and install updates, compresses it in a ZIP archive, and uploads it to an external FTP server.

In this article:fake PoC, LDAPNightmare, malware, PoC

Cybercrime

OnyxC2 Stealer Offers Cybercriminals Enterprise-Grade Theft for $250 a Month

Researchers say the OnyxC2 malware targets more than 200 applications and extensions while evading detection through encrypted payloads, DLL sideloading, and in-memory execution techniques.

Kevin Townsend2 days ago

ICS/OT

Siemens Says Desigo CC Files Flagged as Malware by Security Engines

A PowerShell script included in patch files appears to be triggering false positives by multiple security engines.

Eduard Kovacs2 days ago

Identity & Access

Infostealers Turn Millions of Devices Into Credential Theft Machines

As attackers increasingly favor stolen credentials over exploits, infostealers have become a primary source of access for ransomware and other cybercrime operations.

Kevin Townsend3 days ago

Vulnerabilities

Cisco Warns of Available PoC for Critical Unified CM Vulnerability

The high-severity flaw can be exploited remotely, without authentication, in server-side request forgery (SSRF) attacks.

Ionut ArghireJune 4, 2026

Artificial Intelligence

Russia-Linked ‘GreyVibe’ Attackers Use AI to Supercharge Cyberattacks

Researchers warn GreyVibe’s extensive use of ChatGPT, Gemini, and other AI tools offers a glimpse into how future cybercriminal and state-aligned groups will operate.

Kevin TownsendMay 28, 2026