Malware that targets 19-year old WinRAR bug spreading via e-mail

Remember the 19-year old vulnerability in WinRAR that I wrote about last week? Bleeping Computer reports cybercriminals are now abusing the flaw via an e-mail campaign. This piece of malspam is able to infect your computer with a backdoor by extracting a specially crafted RAR archive. There are some caveats though, the exploit only works if UAC is disabled or if WinRAR is running with administrator privileges.

If UAC is running, when you attempt to extract the archive it will fail to place the malware in the C : ProgramData folder due to lack of permissions. This will cause WinRAR to display an error stating "Access is denied" and "operation failed"[.]

To protect yourself, it's recommended to upgrade to the latest version of WinRAR.