In other cybersecurity news, McAfee reported attackers are exploiting a previously unidentified vulnerability in Microsoft Word, which security researchers said can install malware, even on fully-patched computers. Because the HTML application is executable, the attacker can run code on the affected computer while evading memory-based mitigations designed to prevent these kinds of attacks.

Activation of the vulnerability takes place when a mark opens a fake Word document, which downloads a malicious HTML application from a server, masked as a rich text document file. The HTML application meanwhile downloads and runs a malicious script that can stealthily install malware. The exploit connects to a remote server (controlled by the attacker), downloads a file that contains HTML application content and executes it as an .hta file. Because .hta is executable, the attacker gains full code execution on the victim's machine.

“Thus, this is a logical bug and gives the attackers the power to bypass any memory-based mitigations developed by Microsoft,” McAfee said in a blog post. “At McAfee, we have put significant efforts in hunting attacks such as advanced persistent threats and zero days. Yesterday, we observed suspicious activities from some samples. After quick but in-depth research, we have confirmed these samples are exploiting a vulnerability in Microsoft Windows and Office that is not yet patched.”

The samples detected are organized as Word files (more specially, RTF files with “.doc” extension name). The exploit works on all Microsoft Office versions, including the latest Office 2016 running on Windows 10. The earliest attack McAfee detected dates back to late January.