Threat Actor “ScarCruft” (AKA “APT37” or “RedEyes”) has allegedly exploited an Internet Explorer zero-day flaw to host zero-click malware on toast advertisements. ScarCruft is a hacking group tied to North Korea and is known for targeting victims in South Korea and Europe with phishing, watering hole, and zero-day attacks. In a large-scale attack in May 2024, ScarCruft exploited a zero-day vulnerability in Internet Explorer to install the RokRAT malware on victim systems. RokRAT is designed to exfiltrate data to a Yandex cloud, log keystrokes, monitor for clipboard changes, and capture screenshots every three (3) minutes. ScarCruft has been known to use RokRAT in their attacks over the past few years. Cybersecurity researchers notified Microsoft of the campaign and flaw in August 2024, and although Internet Explorer is out of support, Microsoft released a security update to address the vulnerability tracked as CVE-2024-38178. ScarCruft carried out their campaign by compromising the server of a domestic advertising agency which served the malicious toast ads within a free software used by many in South Korea. Toast ads are pop-ups embedded in software to display notifications or advertisements. The attacker-crafted advertisements contained a malicious iframe which caused a JavaScript file to trigger remote execution via the flaw in Internet Explorer’s “JScript9.dll” file. The malware payloads are injected in the explorer.exe process to evade detection. A payload “rubyq.exe” is dropped into the Windows startup and is scheduled for execution every four (4) minutes. Although Internet Explorer is out of support, it can still be integrated into third-party software, and that software may not have incorporated the latest update to fix this flaw. CTIX analysts will continue to report on new and emerging forms of malware and associated campaigns.