Tag

#apt

1 post tagged #apt.

Analysis · May 20, 2026 · Colten Anderson

The user opened a JPG they could see in the archive. A RAT installed behind it.

CVE-2023-38831 weaponizes the one thing you tell users is safe: opening a file they can see. A WinRAR archive hides a script in a folder named identically to a benign file, and double-clicking the file runs the script. You can't train this away, and WinRAR doesn't auto-update.