North Korean state-sponsored espionage group ScarCruft (APT37, RedEyes) weaponized a high-severity type confusion zero-day vulnerability in the Windows legacy Scripting Engine, tracked as CVE-2024-38178 (CVSS 7.5), to execute zero-click remote code execution. In an operation dubbed “Code on Toast” uncovered by South Korea’s NCSC and AhnLab, the threat actor breached the infrastructure of a domestic digital advertising agency to inject a malicious script named ad_toast into real-time advertising feeds. The compromised feeds served toast banner popups bundled alongside popular freeware utilities, which relied on legacy Internet Explorer WebView components (jscript9.dll) to render remote web content.

The injected payload exploited a flaw in the JScript9 Just-In-Time (JIT) compiler, bypassing prior mitigations for CVE-2022-41128 by altering variable type assumptions during array optimization to trigger arbitrary memory read/write primitives. Once code execution was achieved without user interaction, the exploit deployed the multi-stage RokRAT trojan directly into memory to log keystrokes, capture screenshots, and exfiltrate credentials and sensitive documents using legitimate cloud storage APIs. Microsoft patched the flaw in its August 2024 Patch Tuesday rollout, and CISA subsequently added the vulnerability to its Known Exploited Vulnerabilities catalog.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Legacy web rendering engines embedded within third-party desktop utilities create an unmonitored attack surface, allowing adversaries to achieve zero-click code execution that evades modern browser sandboxes and endpoint inspection.
• Bullet 2 — Strategic & Defender Imperative: Organizations must purge or isolate legacy MSHTML/JScript dependencies, enforce strict software allowlisting for unmanaged freeware utilities, and block unauthorized outbound API calls to consumer cloud storage platforms.