Microsoft patches zero-day bug used for QakBot malware distribution

Microsoft's May Patch Tuesday update fixes a zero-day vulnerability used to distribute QakBot malware. CVE-2024-30051, a privilege escalation flaw in Desktop Window Manager, allows threat actors to gain SYSTEM privileges. Kaspersky discovered the vulnerability and linked it to QakBot activity. QakBot, a banking trojan from 2008, evolved into a dropper for additional malware. Despite a previous takedown, QakBot resurfaced targeting the hospitality industry.