Researchers confirmed such attacks work on all modern Windows operating systems including the latest version of Windows 10 as of the time of writing. HtmlHelper contains several vulnerabilities and bypasses many of Windows 10’s security policies, according to our research.

Unless you’ve altered your default programs, when you click on a CHM file, HtmlHelper will open and render it using Internet Explorer 7.Īttackers can place malicious content inside a CHM file and trick victims into opening it. A program called HtmlHelper, which runs under the process name hh.exe, can open and execute CHM files.

chm files, and this is where our researchers focused their investigation. In fact, they are blocked by Outlook, Microsoft’s email client.īut there is one program that exists on nearly every Windows machine that still opens. When you clicked on the “Help” option in a program, it would load help documentation in a viewer similar to a web browser complete with search, an index, and other navigation tools. Help documentation on a Windows device was originally stored in compiled HTML files (CHM), denoted by the. Windows’ default program used to open these files will execute code stored in the file, which can be used to launch an attack. What is the issue?Ĭomparitech researchers uncovered multiple security vulnerabilities on Windows 10 that can be exploited through Microsoft’s help documentation file extension and the programs used to open them.Īttackers can trick Windows users into downloading and opening malicious files through, for example, an email link or attachment. Vulnerabilities reported to be exploited by Chinese state-sponsored espionage group APT41. Comparitech researchers have identified multiple vulnerabilities that could increase the impact of a phishing attack on all Windows users running up to and including Windows 10 – despite previously being patched by Microsoft.

Chm file