Installer Exploit Targets Multiple Platforms

• •The installer exploit affects multiple platforms including Linux, Windows, and macOS.
• •Users should verify software integrity using Microsoft's code signing certificates.
• •No active exploitation confirmed, but PoC code is available.

An installer exploit affecting `mql` and `cnspec` has been reported, allowing attackers to scan for vulnerabilities across various systems including Linux, Windows, macOS, and cloud environments. The exploit leverages installation scripts that can be executed in Docker containers and Kubernetes environments. Users are urged to verify the integrity of the software by checking the signatures against Microsoft's code signing certificates. The exploit is particularly concerning due to its potential to affect a wide range of platforms, including major cloud services like AWS and Azure. The latest version of the software, 11.66.1, has adopted Azure Trusted Signing, which uses short-lived certificates that rotate approximately every 72 hours. This complicates the verification process, as the thumbprint changes with each release. As of now, there are no confirmed reports of active exploitation in the wild, but the presence of proof-of-concept (PoC) code raises concerns about potential future attacks.