Cybercriminals Weaponizing Legitimate Advanced Installer Tool in Crypto-Mining Attacks

A legitimate Windows tool used for creating software packages called Advanced Installer is being abused by threat actors to drop cryptocurrency-mining malware on infected machines since at least November 2021. "The attacker uses Advanced Installer to package other legitimate software installers,...

A secondhand account of the worst possible timing for a scammer to strike

Welcome to this weeks edition of the Threat Source newsletter. Up until last week, I had never considered the timing of a scam to be important. Im so used to just swiping away emails or text messages at random times during the day that Id never considered what would happen if an adversary happene...

Cybercriminals target graphic designers with GPU miners

Cybercriminals are abusing Advanced Installer, a legitimate Windows tool used for creating software packages, to drop cryptocurrency-mining malware on infected machines. This activity has been ongoing since at least November 2021. The attacker uses Advanced Installer to package other legitimate...

CVE-2023-25396

Privilege escalation in the MSI repair functionality in Caphyon Advanced Installer 20.0 and below allows attackers to access and manipulate system files...

CVE-2023-25396

Privilege escalation in the MSI repair functionality in Caphyon Advanced Installer 20.0 and below allows attackers to access and manipulate system files...

Privilege escalation

Privilege escalation in the MSI repair functionality in Caphyon Advanced Installer 20.0 and below allows attackers to access and manipulate system files...

PT-2023-20046 · Caphyon · Caphyon Advanced Installer

Name of the Vulnerable Software and Affected Versions: Caphyon Advanced Installer versions 20.0 and below Description: The issue concerns a privilege escalation in the MSI repair functionality, allowing attackers to access and manipulate system files. Recommendations: For versions 20.0 and below,...

CVE-2023-25396

Privilege escalation in the MSI repair functionality in Caphyon Advanced Installer 20.0 and below allows attackers to access and manipulate system files...

CVE-2023-25396

Privilege escalation in the MSI repair functionality in Caphyon Advanced Installer 20.0 and below allows attackers to access and manipulate system files...

CVE-2023-25396

CVE-2023-25396 affects Caphyon Advanced Installer (MSI repair functionality) with privilege escalation in versions 20.0 and below. The root cause is an elevation of privilege via the MSI repair feature, allowing an attacker to access and manipulate system files. Relevant sources consistently desc...

CVE-2022-27438

Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer Advanced Updater are affected by a remote code execution vulnerability via the CustomDetection parameter in the update check function. To exploit this vulnerability, a user must start an...

CVE-2022-27438

Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer Advanced Updater are affected by a remote code execution vulnerability via the CustomDetection parameter in the update check function. To exploit this vulnerability, a user must start an...

Remote code execution

Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer Advanced Updater are affected by a remote code execution vulnerability via the CustomDetection parameter in the update check function. To exploit this vulnerability, a user must start an...

CVE-2022-27438

Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer Advanced Updater are affected by a remote code execution vulnerability via the CustomDetection parameter in the update check function. To exploit this vulnerability, a user must start an...

EUVD-2022-31941

Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer Advanced Updater are affected by a remote code execution vulnerability via the CustomDetection parameter in the update check function. To exploit this vulnerability, a user must start an...

CVE-2022-27438

Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer Advanced Updater are affected by a remote code execution vulnerability via the CustomDetection parameter in the update check function. To exploit this vulnerability, a user must start an...

CVE-2022-27438

CVE-2022-27438 affects Caphyon Advanced Installer 19.3 and earlier and products using the Advanced Updater. The root cause is a remote code execution vulnerability in the update check function via the CustomDetection parameter. Exploitation requires starting an affected installation to trigger th...

Caphyon Ltd Advanced Installer 安全漏洞

Caphyon Ltd Advanced Installer is a powerful and easy-to-use Windows installer authoring tool from Caphyon Romania. It is used to install, update and configure products safely and securely. A security vulnerability exists in Caphyon Ltd Advanced Installer version 19.2, which stems from a Remote...

Exploit for Download of Code Without Integrity Check in Caphyon Advanced_Installer

CVE-2022-27438 Caphyon Ltd Advanced Installer 19.3 "CustomDe...

PT-2022-3208

Name of the Vulnerable Software and Affected Versions Caphyon Advanced Installer versions 19.3 and earlier Description The issue is related to the Advanced Updater function in Caphyon Advanced Installer, which is vulnerable to remote code execution due to the lack of integrity check when handling...