Threat actors have been observed utilizing CVE-2023-36025, a bypass vulnerability for Windows SmartScreen, to deliver the open-source malware Phemedrone Stealer. Phemedrone Stealer is an information stealer malware that targets web browsers, messaging applications like Telegram and Discord, and cryptocurrency wallets. Once the data is compromised, it is returned to the threat actors through Telegram and their command-and-control (C2) server infrastructure. Phemedrone is deployed using CVE-2023-36025, a vulnerability that involves tricking the victim into clicking on a .URL file that has been shortened and masked with URL shorteners and then posted to the messaging app. After clicking the malicious link, the .URL file connects to the threat actor’s C2 server before executing a control panel file that takes advantage of CVE-2023-36025 to call rundll32.exe. This DLL uses Windows PowerShell to download a shellcode loader that executes the Phemedrone Stealer malware. According to Trend Micro, Phemedrone Stealer can target the following pieces of data: Chromium browser, cryptocurrency wallets, system information for the infected device, Telegram, and Gecko browsers (IE Firefox). This campaign has been seen still utilizing CVE-2023-36025 despite the vulnerability having been patched by Microsoft in November 2023, demonstrating how important it is to keep your systems up to date to avoid exploitation of known CVEs. CTIX analysts will continue to monitor the development of Phemedrone Stealer.