Similar to a vulnerability Microsoft patched just last week Credit: Thinkstock Microsoft on Tuesday warned Windows users that cyber criminals are exploiting a zero-day vulnerability using malicious PowerPoint documents sent as email attachments. In an advisory, Microsoft outlined the bug and provided a one-click tool from its “Fixit” line that customers can use to protect their PCs until a patch is available. Although Microsoft does not label its advisories with the same four-step threat scoring system it uses for security updates, it said that a successful exploit would let hackers hijack the PC so that they could, for example, steal information or plant other malware on the machine. The vulnerability affects all versions of Windows, from the aging Windows Vista to the very newest Windows 8.1, and is within the operating system’s code that handles OLE (object linking and embedding) objects. OLE is most commonly used by Microsoft Office for embedding data from an Excel spreadsheet in, say, a Word document. “At this time, we are aware of limited, targeted attacks that attempt to exploit the vulnerability through Microsoft PowerPoint,” the advisory said. Other Office file types, however, could also be used to exploit the flaw. Ironically, Microsoft patched a similar vulnerability last week when it issued eight updates, including one that addressed a bug in OLE which, like Tuesday’s revelation, had been exploited in the wild before a patch was pushed to customers. That update was designated MS14-060 by Microsoft, and was also being exploited using malformed PowerPoint files. According to researchers at iSight Partners, the flaw fixed by MS14-060 had been used by a Russian hacker crew to target Ukrainian government agencies, NATO, Western European government agencies and companies in the telecommunications and energy sectors, since at least December 2013. iSight slapped the moniker “Sandworm” on the cyber-spy gang. While iSight got the credit for finding the OLE vulnerability Microsoft patched last week, a trio of Google security engineers and a pair from McAfee Security reported the latest bug. Microsoft did not explicitly promise to patch the zero-day, but it certainly will. The only question is when. Its next regularly-scheduled Patch Tuesday is Nov. 11, or three weeks from today. Historically, Microsoft has been hesitant to issue an emergency security update unless attack have spread widely and affected large numbers of customers. In the meantime, Microsoft has crafted a Fixit tool that, if applied, blocks the attacks seen so far. The tool is located on this support page. Microsoft also urged Windows users to pay attention to the User Account Control (UAC) pop-ups, the small alerts that require authorization before the OS is allowed to perform certain chores, like downloading files or running software. UAC, which many Windows users see as an inconvenience — and many habitually click through without a second thought — will detect the malformed PowerPoint file and not run its hidden malware without permission. “In observed attacks, User Account Control (UAC) displays a consent prompt or an elevation prompt, depending on the privileges of the current user, before a file containing the exploit is executed,” Microsoft’s advisory said. Related content news Dropbox adds end-to-end encryption for team folders Dropbox this week unveiled a range of features, including security updates and key management, and the ability to co-edit Microsoft 365 documents from within the file-sharing app. By Matthew Finnegan Apr 26, 2024 3 mins Cloud Storage Collaboration Software Productivity Software feature Android versions: A living history from 1.0 to 15 Explore Android's ongoing evolution with this visual timeline of versions, starting B.C. (Before Cupcake) and going all the way to 2024's Android 15 (beta) release. By JR Raphael Apr 26, 2024 23 mins Small and Medium Business Smartphones Android news analysis The unspoken obnoxiousness of Google's Gemini improvements Google's Gemini chatbot is seeing all sorts of upgrades on Android this week, but those advancements reveal a darker underlying reality. By JR Raphael Apr 26, 2024 12 mins Google Assistant Google Android news analysis Google can’t seem to quit cookies, delays killing them again Google cited regulatory challenges in its oft-delayed plans to phase out third-party cookies from its Chromium products. It now plans to eliminate cookies in 2025 By Lucas Mearian Apr 25, 2024 5 mins Chrome Browser Security Chrome OS Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe