CVE-2025-4632

CVE

Threat entity extracted from intelligence sources

Frequency

occurrences

First Seen

September 24, 2026

Last Seen

September 25, 2026

API

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Attackers Compile Cryptominer on Victim Endpoint via Samsung MagicINFO Exploit70.5

In early September 2026, a threat actor exploited CVE-2025-4632, a vulnerability in Samsung MagicINFO, to compile a cryptominer directly on a victim's endpoint. The attack began with the installation of a rogue AnyDesk instance after multiple failed attempts, followed by creating a new local admin a...