Phishing operation exploits Windows Mshta for credential theft

A phishing campaign active since June is abusing Microsoft’s legitimate mshta. exe utility to run malicious HTML Application files, profile infected Windows systems and deliver follow-on malware capable of stealing credentials and other local secrets, security researchers have found.

Fortra Intelligence and Research Experts, known as FIRE, said the operation remains active and is primarily targeting Spanish-speaking users at global organisations. The attackers use Spanish-language invoice and judicial-notice lures to persuade recipients to follow malicious links, while continually changing samples and file hashes in an effort to evade signature-based detection.

The attack chain begins with phishing messages that commonly originate from infrastructure associated with the Italian free-email service libero. it, although FIRE also observed one sample delivered through Microsoft 365 infrastructure. The messages direct victims through URL-shortening services to an intermediate page that ultimately causes an HTA file to be downloaded.

When a victim opens the HTA, Windows invokes mshta. exe, a legitimate Microsoft utility designed to execute HTML Applications. The malicious file pushes its own window off-screen and loads remote JavaScript, allowing the activity to proceed with little visible indication to the user.

The second stage gathers information about the compromised computer using Windows Management Instrumentation, PowerShell and environment variables. FIRE said the reconnaissance can include the operating-system version, BIOS details and user name, giving the attackers information that can be used to decide which later payload to deploy.

The JavaScript stage then reconstructs a Base64-encoded ZIP archive through HTML smuggling and initiates a download. Researchers found that the archive contains a 7-Zip self-extracting executable disguised as a Firefox installer. Once run, it extracts and launches the next payload from a temporary directory.

FIRE said the campaign’s apparent objective is to steal local secrets through an information stealer, although the multi-stage design could support other payloads. The architecture allows the operators to make deployment decisions after collecting system characteristics rather than sending the same final malware to every target.

Researchers also observed several measures intended to complicate detection. These include random file names, off-screen HTA execution, embedded Base64 content and polymorphic executables whose hashes vary between samples. FIRE said the attackers have been recompiling samples regularly, reducing the usefulness of static hash-based blocking.

The campaign is notable for its consistent Spanish-language artefacts. Email headers, social-engineering text, user-interface strings and source-code comments were all observed in Spanish. Some intermediate content contained Portuguese-language elements, which FIRE said could indicate reused infrastructure or templates, but it did not establish a separate attribution from that evidence.

Microsoft’s mshta. exe has long been recognised as a potential route for malicious code execution because it can run HTA files and scripts through a trusted Windows binary. MITRE ATT&CK classifies abuse of mshta as a system-binary proxy execution technique, noting that attackers can use it to execute malicious HTA, JavaScript or VBScript content and potentially bypass controls that trust signed system utilities.

That legitimate role makes behavioural monitoring important. MITRE recommends looking for mshta. exe command lines that reference suspicious local or remote HTA or script content, particularly where execution is followed by file creation, network retrieval or child-process activity. It also notes that organisations which do not require mshta can consider disabling or restricting it.

Fortra advised defenders to alert on mshta. exe running from user-writable locations such as Downloads, Desktop or AppData, and to restrict the utility through Windows application-control mechanisms where operationally practical. It also recommended monitoring for the off-screen HTA pattern, suspicious HTML-smuggling behaviour and later-stage archive extraction followed by PowerShell or WMI activity.

The researchers additionally urged organisations to examine mail-flow rules where messages receive a Spam Confidence Level of minus one, a setting that can cause mail to bypass normal spam filtering. Across four samples analysed by FIRE, that value appeared even when the messages were categorised as phishing, prompting the company to recommend audits of allow-listing and gateway configurations.