As September 2026 unfolds, security researchers have uncovered an active exploitation campaign targeting an unpatched or neglected attack surface in Samsung MagicINFO software. Utilizing CVE-2025-4632, attackers are successfully obtaining high-level system privileges on Windows endpoints to compile and run Monero-mining malware, underscoring the persistent danger posed by known vulnerabilities long after official patches drop.
The Anatomy of an Unpatched Vulnerability
The core vector of this ongoing campaign relies on CVE-2025-4632, a critical security flaw that enables malicious actors to write files with high system privileges onto targeted Windows endpoints. Documentation from software maintainers shows that this specific loophole was formally addressed via a software fix back in May 2025. That patch had become necessary after an earlier remediation for the related CVE-2024-7399 vulnerability proved to be incomplete.
Despite the availability of these fixes for well over a year, attackers continue to exploit legacy installations. In early September 2026, security service provider Huntress investigated an infected Windows endpoint and uncovered alarming persistence from the threat actors. Exactly eight days after an initial warning was sounded, the same malicious entities returned to target the exact same endpoint through identical access vectors.
Patient Persistence and Evasion Tactics
The attackers behind this cryptocurrency-mining campaign exhibited notable patience when dealing with endpoint detection and response systems. During their attempts to establish a persistent remote foothold, the deployment of the AnyDesk remote maintenance software required three distinct tries. Microsoft Defender successfully intercepted and blocked the first two download attempts before the intrusion finally succeeded.
Once inside the environment, the threat actors wasted no time consolidating their access. They provisioned a local administrator account and systematically disabled Microsoft’s integrated security software.
On-Device Compilation and Process Camouflage
A distinct technical fingerprint of this campaign involves how the malicious payload is delivered and executed. Rather than dropping a pre-compiled binary onto the host machine, the attackers actually compiled the Monero miner directly on the victim’s hardware. This heavy compilation process generated unusual CPU spikes, which ultimately drew scrutiny and led to the discovery of the intrusion.
To avoid detection during ongoing operations, the compiled miner disguised itself as a legitimate Windows Explorer process. It then established direct communication channels with the C3Pool mining pool to siphon computational resources for cryptocurrency generation. The total scope of this campaign across global networks remains undetermined.
The Parallel Surge in ClickFix Social Engineering
While software-based exploits like CVE-2025-4632 target backend administrative software, threat actors are simultaneously scaling up user-facing manipulation tactics. Security analysts from Manifold Security recently flagged an aggressive wave of ClickFix attacks utilizing the domain third-party[.]com. Because this address lacks the reserved status of standard placeholder domains like example.com, attackers have weaponized it for deceptive cloud verification prompts.
In these scenarios, users are greeted with a fake Cloudflare security check. Interacting with the prompt copies a malicious command straight into the user’s clipboard. The user is then tricked into running the sequence via the Win+R keyboard shortcut, executing a PowerShell script that silently pulls further payloads. Registrar Network Solutions has been formally notified regarding the malicious utilization of the domain.
Market data compiled by ESET illustrates the explosive growth of this attack vector. Detection rates for ClickFix campaigns surged from the second half of 2025 to the first half of 2026. This builds upon an increase recorded during the prior reporting period, signaling a clear shift toward exploiting human behavior over complex zero-day code.
