Stealth Falcon Exploits Windows Zero-Day Against the Defense Sector

Stealth Falcon exploited CVE-2025-33053 in a targeted attack against the Defense sector reported in June 2025. A malicious internet shortcut, believed to have been delivered in a phishing archive, executed malware from an attacker-controlled WebDAV server. Horus Loader then installed Horus Agent, an espionage tool capable of gathering system information, downloading files, and injecting shellcode.