Attackers exploited a known vulnerability in Samsung’s MagicINFO software to gain access to a Windows system This article explores vulnerability samsung magicinfo. . The incident began in early September 2026 with an alert related to MagicINFO Premium, used for managing digital signs.
The attackers installed a remote access tool, created an administrator account, and disabled Microsoft Defender before using the compromised system’s processing power to mine Monero. Hackers Exploited a Samsung Flaw Samsung addressed the flaw in May 2025 following an earlier MagicINFO issue, which our previous coverage of the MagicINFO file writing vulnerability explains why internet-facing installations required prompt updates. The first alert prompted customers to remediate their systems, but eight days later investigators observed new activity linked to the same access route.
Process records traced the activity back through the service running MagicINFO, which helped investigators connect the remote access installation to the original flaw rather than an unrelated change. The report describes this as an opportunity for defenders to detect the attack before the finished miner started functioning, without needing a signature for the final file. The 'Main Features' of SilentXMRMiner on GitHub (Source: Huntress) revealed mining options within Windows Explorer, indicating malicious code had been inserted into the process.
Huntress recommends promptly patching internet-facing MagicINFO installations and treating repeated attempts to download remote access tools as potential signs of intrusion.
