A DarkGate Malware campaign observed mid-January 2024 has been exploiting a Windows Defender SmartScreen flaw which is now patched in Microsoft’s February Patch Tuesday release. The flaw – CVE-2024-21412 – allows certain files to bypass the security warning that SmartScreen is designed to display when unrecognized or suspicious files are detected. The flaw is exploited through a “.url” file that points to yet another “.url” file hosted on a remote SMB share which causes the file at the final location to be executed automatically. The malware campaign begins as most do – with a phishing email. The email contains a PDF document including links that utilize redirects from Google DoubleClick Digital Marketing services to evade email security checks. The link in the PDF file directs the victim to a compromised webserver which leads to the exploitation of the SmartScreen flaw by executing a malicious MSI file. The MSI file masquerades as a legitimate software installer for NVIDIA, Apple iTunes, or Notion. The MSI installer exploits a different flaw in DLL sideloading to decrypt and execute the DarkGate malware on the system. DarkGate is an infostealer, and can fetch additional payloads, perform key logging, and provide attackers with remote access to the impacted device. This campaign serves as another reminder for organizations to patch their systems and to educate users on phishing techniques. CTIX analysts will continue to report on new strains of malware and malware campaigns.