Loading story…
Researchers disclosed a class of one-click remote code execution flaws in desktop applications that passed user-controlled URLs to the operating system without tightly restricting URI schemes or destinations. The issue affected multiple widely used clients, including Nextcloud, Telegram Desktop, VLC, OpenOffice, LibreOffice, Mumble, Wireshark, and several Bitcoin-derived wallets, where a single click on a crafted link could trigger unsafe URI handlers, auto-mount remote shares, or launch attacker-controlled content depending on the operating system and desktop environment. The researchers said exploitation was shaped by platform behavior, and warned that application-level fixes alone were not enough without changes in operating systems and frameworks such as Qt.
A related case showed how the same pattern led to practical exploitation in Keybase on Windows, where specially formatted chat links could display benign text while pointing to arbitrary URI targets. In that scenario, attacker-controlled payment-request content using Lumens (XLM) could be turned into clickable links that executed local or SMB-hosted programs when clicked, creating a viable one-click RCE path. Vendors responded with a mix of mitigations, including restricting allowed schemes, adding warnings, changing URL-opening behavior, removing separate display fields, and forcing non-HTTP(S) links to be prefixed safely, although some products were still awaiting fixes at the time of disclosure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Positive Security published research describing a class of one-click code execution vulnerabilities in desktop applications that pass user-controlled URLs to the operating system without sufficiently restricting URI schemes or destinations. The write-up identified affected applications including Nextcloud, Telegram Desktop, VLC, OpenOffice, LibreOffice, Mumble, Bitcoin-derived wallets, and Wireshark, and noted that several vendors had patched while some products remained vulnerable.
Shielder reported a one-click remote code execution issue in Keybase chat clients on Windows caused by unsafe handling of specially formatted link objects. The vendor fixed the issue by removing the separate display field and forcing non-HTTP(S) URLs to be prefixed with http://, blocking the RCE path.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed **CVE-2025-33053**, an **Important** remote code execution flaw in **Internet Shortcut Files** that affects all supported versions of Windows and carries a **CVSS 8.8** rating. The vulnerability is tied to **CWE-73** (external control of file name or path) and can let an unauthenticated attacker execute code over a network if a user clicks a specially crafted URL. Microsoft said the bug had been **exploited in the wild**, that **functional exploit code** was available, and that security updates had been released. The advisory said the issue has implications beyond legacy browser use because underlying **MSHTML**, **EdgeHTML**, and scripting components remain supported on some platforms and are still used by **Internet Explorer mode**, the **WebBrowser control**, **WebView**, and some **UWP** applications. Microsoft also noted that **IE cumulative updates** still matter for certain older Windows Server systems, and later revised the advisory to correct the CVE title and description without changing the technical impact. Related Microsoft advisories show the flaw joins a broader pattern of remote code execution risks across Windows and server products, including **MSHTML**, **Hyper-V**, **Exchange Server**, and **SharePoint Server**.
Jun 29, 2026
Microsoft patched a high-severity **remote code execution** issue in the modern *Windows Notepad* (Microsoft Store version) tracked as **CVE-2026-20841**, where improper validation of links in Markdown (`.md`) files can lead to arbitrary command execution in the context of the logged-in user. The flaw can be triggered when a victim opens a specially crafted Markdown file and clicks a rendered hyperlink; Notepad’s Markdown rendering/tokenization pipeline turns link text into interactive elements, and the click handler passes attacker-controlled link values onward with insufficient sanitization. Technical reporting indicates Notepad forwards the link target to `ShellExecuteExW()` with only minimal filtering (e.g., stripping leading/trailing slashes), allowing malicious protocol URIs such as `file://` and `ms-appinstaller://` to be invoked via registered protocol handlers. Exploitation is primarily social-engineering driven (email, downloads, or other delivery mechanisms) and requires user interaction (opening the file and clicking the link), but can result in execution of attacker-chosen commands or loading attacker-controlled content depending on protocol handler behavior and system configuration; the issue was disclosed via **Zero Day Initiative** and credited to researchers including Cristian Papa and Alasdair Gorniak (Delta Obscura), with additional analysis referenced by third-party reporting.
Jul 4, 2026
A high-severity flaw in **OpenClaw** (also known as *Clawdbot* / *Moltbot*) enables **one-click remote code execution (RCE)** by abusing how the Control UI auto-connects to a gateway specified via a crafted URL. The issue is tracked as **CVE-2026-25253** (CVSS **8.8**) and was fixed in **OpenClaw 2026.1.29**; the core weakness is that the UI trusts `gatewayUrl` from the query string and sends a stored gateway token in the WebSocket connection payload, allowing **token exfiltration** to an attacker-controlled server. With the stolen token, an attacker can connect to the victim’s local gateway and perform privileged actions—such as modifying configuration (e.g., sandbox/tool policies) and invoking privileged operations—resulting in **full gateway compromise** and RCE. Separate reporting also highlights architectural risk in OpenClaw’s local WebSocket-based Chrome orchestration, noting that (prior to patching) unauthenticated connections could be initiated from JavaScript running in a user’s browser, enabling cross-tab/session credential theft; users are advised to **patch immediately** and be cautious about deployment given ongoing security concerns.
Jun 29, 2026