RenderShock 0-Click Vulnerability Executes Payloads via Background Process Without User Interaction

Security teams should implement comprehensive defenses, including disabling preview panes in Windows Explorer and Quick Look on macOS, blocking outbound SMB traffic (TCP 445) to untrusted networks, and enforcing macro blocking through Group Policy. Foundational payloads include malicious LNK files with UNC icon paths that cause Windows Explorer to initiate NTLM authentication when browsing folders, and RTF files containing INCLUDEPICTURE field injections that fetch remote resources during preview. The vulnerability affects Windows Explorer Preview Pane, macOS Quick Look, email client preview systems, and file indexing services, including Windows Search Indexer and Spotlight. The vulnerability enables multiple attack vectors, including reconnaissance through passive beacons, credential theft via NTLMv2 harvesting, and remote code execution through preview-based macro execution. These systems process files in memory, often invoking registered preview handlers that can trigger malicious code execution. Unlike traditional phishing campaigns that rely on users clicking malicious links or opening infected attachments, RenderShock leverages built-in system automation features to achieve compromise through legitimate background processes. Uses malicious LNK files, PDFs, and Office documents to trigger NTLM theft and code execution. Advanced techniques involve polyglot file formats that confuse multiple parsers, remote template injection in Office documents without macros, and poisoned ICC color profiles in images. RenderShock attacks exploit file preview systems without requiring user interaction. Enables credential harvesting and remote access; requires disabling preview panes and blocking SMB traffic.

This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 14 Jul 2025 13:15:13 +0000

Cyber News related to RenderShock 0-Click Vulnerability Executes Payloads via Background Process Without User Interaction

RenderShock 0-Click Vulnerability Executes Payloads via Background Process Without User Interaction - Security teams should implement comprehensive defenses, including disabling preview panes in Windows Explorer and Quick Look on macOS, blocking outbound SMB traffic (TCP 445) to untrusted networks, and enforcing macro blocking through Group Policy. ...
6 months ago Cybersecuritynews.com

Hackers push USB malware payloads via news, media hosting sites - A financially motivated threat actor using USB devices for initial infection has been found abusing legitimate online platforms, including GitHub, Vimeo, and Ars Technica, to host encoded payloads embedded in seemingly benign content. The attackers ...
2 years ago Bleepingcomputer.com

Click Profit blocked by the FTC over alleged e-commerce scams - Click Profit is an online business paltform promoted on social media and through websites that claims to help consumers generate passive income by setting up and managing e-commerce stores on Amazon, Walmart, and other platforms. The US Federal Trade ...
10 months ago Bleepingcomputer.com

Monthly Threat Webinar Series in 2023: What to Expect - We firmly believe that the internet should be available and accessible to anyone and are committed to providing a website that is accessible to the broadest possible audience, regardless of ability. These guidelines explain how to make web content ...
3 years ago Trendmicro.com

New Malware Uses Fileless Technique to Deploy Ransomware - The group behind the Windows Gootloader malware, known as UNC2565, has effectively modified the code to make it more intrusive and difficult to detect. Researchers at Mandiant noted UNC2565 started making significant adjustments to its operational ...
3 years ago Cybersecuritynews.com

Russian hackers use Ngrok feature and WinRAR exploit to attack embassies - After Sandworm and APT28, another state-sponsored Russian hacker group, APT29, is leveraging the CVE-2023-38831 vulnerability in WinRAR for cyberattacks. APT29 is tracked under different names and has been targeting embassy entities with a BMW car ...
2 years ago Bleepingcomputer.com CVE-2023-38831 APT28 APT29

Microsoft says malvertising campaign impacted 1 million PCs - The malvertising videos redirected users to the GitHub repos that infected them with malware designed to perform system discovery, collect detailed system info (e.g., memory size, graphic details, screen resolution, operating system (OS), and user ...
11 months ago Bleepingcomputer.com

How to Share a Wi-Fi Password: A Step-by-Step Guide - You can unsubscribe at any ...
1 year ago Techrepublic.com

Threat Actors Weaponizing GitHub Accounts To Host Payloads, Tools and Amadey Malware Plug-Ins - The operation leverages fake GitHub accounts to host an arsenal of malware tools, plugins, and payloads, capitalizing on GitHub’s widespread corporate acceptance to bypass traditional web filtering mechanisms. The researchers discovered that ...
6 months ago Cybersecuritynews.com

Vulnerability Summary for the Week of January 15, 2024 - This vulnerability affected all versions of GitHub Enterprise Server and was fixed in versions 3.11.3, 3.10.5, 3.9.8, and 3.8.13 This vulnerability was reported via the GitHub Bug Bounty program. Successful attacks require human interaction from a ...
2 years ago Cisa.gov

ExpressVPN Review (2024): Pricing, Features, Pros, & Cons - You can unsubscribe at any ...
1 year ago Techrepublic.com

ID Theft Service Resold Access to USInfoSearch Data - One of the cybercrime underground's more active sellers of Social Security numbers, background and credit reports has been pulling data from hacked accounts at the U.S. consumer data broker USinfoSearch, KrebsOnSecurity has learned. Since at least ...
2 years ago Krebsonsecurity.com Hunters

CVE-2024-47706 - In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix possible UAF for bfqq->bic with merge chain 1) initial state, three tasks: Process 1 Process 2 Process 3 (BIC1) (BIC2) (BIC3) | ? | ? | ? | | | | | | V | V | V | ...
1 year ago Tenable.com

Apple 'AirBorne' flaws can lead to zero-click AirPlay RCE attacks - According to cybersecurity company Oligo Security security researchers who discovered and reported the flaws, they can be exploited in zero-click and one-click RCE attacks, man-in-the-middle (MITM) attacks, and denial of service (DoS) attacks, as ...
9 months ago Bleepingcomputer.com CVE-2025-24206

Threat Actors Weaponize Windows Screensavers Files to Deliver Malware - Malware operators continue exploiting the Windows Screensaver (.scr) file format to distribute malicious payloads, leveraging its executable nature under the guise of harmless system files. One prominent example involves attackers impersonating a ...
10 months ago Cybersecuritynews.com

Critical Microsoft Telnet 0-Click Vulnerability Exposes Windows Credentials - “A critical 0-click remote authentication bypass vulnerability in Microsoft Telnet Server allows attackers to gain access as any user, including Administrator, without requiring valid credentials,” according to security researchers who ...
9 months ago Cybersecuritynews.com

0-Click Linux Kernel KSMBD RCE Exploit - A critical zero-click remote code execution (RCE) vulnerability has been discovered in the Linux kernel's KSMBD component, which handles SMB3 protocol operations. This flaw allows attackers to execute arbitrary code on vulnerable systems without any ...
4 months ago Cybersecuritynews.com CVE-2023-38408

WhatsApp bug exploited in zero-click iPhone attacks - A critical vulnerability in WhatsApp has been exploited in zero-click attacks targeting iPhones, raising significant concerns about mobile security. This flaw allows attackers to compromise devices without any interaction from the user, highlighting ...
5 months ago Darkreading.com CVE-2023-XXXX Unknown sophisticated threat actor group

Hackers are Using ClickFix Techniques to Deliver NetSupport RAT, Latrodectus and Lumma Stealer Malware - Cyber Security News - A carefully crafted landing page instructs victims to open the Run dialog (Win+R) and paste an injected PowerShell command, which subsequently downloads a ZIP archive containing a malicious DLL loader. At the heart of the ClickFix vector is ...
6 months ago Cybersecuritynews.com

Weaponization of LNK Files Surge by 50% and Primarily Used in Four Different Malware Categories - These seemingly innocuous files, identifiable by their small arrow icon overlay, are increasingly being weaponized by threat actors to execute malicious payloads while maintaining a facade of legitimacy. Their research revealed that threat actors ...
7 months ago Cybersecuritynews.com

CVE-2025-39989 - In the Linux kernel, the following vulnerability has been resolved: ...
9 months ago

WebAuthn Conditional UI - Despite its recent introduction and ongoing adoption by browsers, there's a noticeable gap in technical documentation and implementation advice for Conditional UI. This article aims to bridge that gap by explaining what Conditional UI is, how it ...
2 years ago Feeds.dzone.com

Pirated Microsoft Office delivers malware cocktail on systems - Cybercriminals are distributing a malware cocktail through cracked versions of Microsoft Office promoted on torrent sites. The malware delivered to users includes remote access trojans, cryptocurrency miners, malware downloaders, proxy tools, and ...
1 year ago Bleepingcomputer.com

Android 0-Click RCE Vulnerability Exposes Millions to Remote Attacks - A critical zero-click remote code execution (RCE) vulnerability has been discovered in Android devices, posing a significant threat to millions of users worldwide. This flaw allows attackers to execute arbitrary code remotely without any user ...
3 months ago Cybersecuritynews.com CVE-2024-12345

CVE-2021-38788 - The Background service in Allwinner R818 SoC Android Q SDK V1.0 is used to manage background applications. Malicious apps can use the interface provided by the service to set the number of applications allowed to run in the background to 0 and add ...
3 years ago