Loading story…
Bitdefender warned that attackers are increasingly abusing Microsoft’s legacy mshta.exe utility as a living-off-the-land tool to execute remote or in-memory scripts and deliver malware including LummaStealer, Amatera, CountLoader, Emmenhtal Loader, ClipBanker, and PurpleFox. The campaigns rely on phishing, fake software downloads, SEO poisoning, cracked-software lures, fake social media posts, Discord messages, and ClickFix-style fake CAPTCHA or reCAPTCHA prompts that trick users into launching malicious commands. Researchers said much of the observed mshta.exe traffic was tied to typosquatted or attacker-controlled domains masquerading as legitimate services, with payloads focused on credential theft, session cookie theft, cryptocurrency wallet theft, and persistent compromise.
One highlighted infection chain used a fake Setup.exe containing a bundled Python interpreter and a renamed MSHTA binary to retrieve additional payloads, while other chains used fileless execution through PowerShell, WScript, HTA content, and even msiexec to fetch disguised installer packages. Bitdefender said legitimate enterprise use of MSHTA is declining while malicious use is rising, and noted that although VBScript was deprecated in 2024 and is expected to be disabled by default in 2027, Microsoft has not indicated plans to remove MSHTA. The company urged defenders to disable or restrict mshta.exe and wscript.exe where possible, migrate away from legacy scripts, improve user awareness, and rely on layered behavioral and runtime defenses.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
Bitdefender recommended that organizations disable or restrict mshta.exe and wscript.exe where possible, migrate away from legacy scripts, improve user awareness, and use layered behavioral and runtime defenses. The guidance accompanied its reporting on the renewed abuse of MSHTA in modern malware campaigns.
Researchers linked Emmenhtal Loader and LummaStealer delivery to fake CAPTCHA, fake reCAPTCHA, and human-verification pages that trick victims into pasting malicious commands. Those commands launched MSHTA filelessly in memory and led to infostealer infections.
Bitdefender described a CountLoader infection chain in which a fake Setup.exe, actually a bundled Python interpreter with a renamed MSHTA binary, retrieved payloads from attacker-controlled domains masquerading as trusted services. The infrastructure reportedly shifted from .cc domains to .vg and .gl domains over time.
Bitdefender reported a sharp increase in malicious MSHTA detections and said most observed MSHTA-related traffic was tied to typosquatted or attacker-controlled infrastructure rather than benign enterprise use. The researchers said the increase had been visible since the start of 2026 as legitimate administrative use continued to decline.
Bitdefender documented ongoing abuse of the legacy Windows utility mshta.exe in delivery chains for LummaStealer, Amatera, CountLoader, Emmenhtal Loader, ClipBanker, and PurpleFox. The campaigns used HTA scripts, PowerShell, WScript, msiexec, phishing, fake software downloads, cracked software lures, Discord phishing, and ClickFix-style prompts to execute malware.
Microsoft deprecated VBScript in the second half of 2024 and announced plans to disable it by default in 2027 and remove it from Windows entirely. Bitdefender noted there was no public indication that MSHTA would be removed alongside it.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 175 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcegovinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcebitdefender.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented multiple **Lumma Stealer** infection chains that begin with fake CAPTCHA or verification pages and trick Windows users into launching malicious PowerShell from the Run dialog. In one case, victims reached the lure through malicious pop-up ads on a pirated-content site; in another, a page at `you-checked.com` copied a hidden command to the clipboard that fetched follow-on payloads from domains including `ferrydero.com` and `fill-tomap.com`. The malware family, also known as **LummaC2**, is a malware-as-a-service infostealer designed to steal browser data, credentials, cryptocurrency wallets, session tokens, and other sensitive information. The observed chains used `mshta.exe`, obfuscated HTA and JavaScript, layered PowerShell stages, and multiple packed .NET components to retrieve and execute the final payload while evading analysis. Analysts reported AES and XOR decryption, SmartAssembly and .NET Reactor packing, AMSI bypass attempts, anti-sandbox and anti-debugging checks, Windows Defender evasion, and cleanup steps such as deleting downloaded archives after execution. One intrusion created files under `C:\ProgramData`, contacted `iplogger.co`, and launched an infostealer executable named `jegule.exe`, while another sample ultimately communicated through `winhttp.dll` and `ws2_32.dll`; investigators also recovered additional URLs from a Steam Community profile using ROT15 decoding.
Jul 7, 2026
Multiple Windows-focused malware campaigns were reported leveraging *trusted distribution and execution paths* rather than exploiting software vulnerabilities. One campaign attributed to **Larva-25012** disguised proxyware as legitimate *Notepad++* installers distributed via fake cracked-software portals and deceptive ads, primarily impacting South Korea. The payloads were hosted on GitHub and delivered as MSI/ZIP packages containing legitimate components plus malicious DLLs, using **DLL side-loading** and process injection into **Windows Explorer** to deploy proxyware (e.g., **Infatica** and **DigitalPulse**) for **proxyjacking**—monetizing victims’ internet bandwidth by reselling access through their networks. A separate multi-stage Windows malware operation used business-themed lures and weaponized archives containing **LNK** shortcuts to run hidden **PowerShell** with execution-policy bypass, pulling an obfuscated loader from GitHub and using legitimate services (e.g., **Dropbox**) to blend into normal traffic. Fortinet-reported tradecraft included persistence, decoy document generation, and beaconing via the **Telegram Bot API**, followed by defense evasion through abuse of **Defendnot** to disable Microsoft Defender before dropping follow-on payloads such as ransomware, banking trojans, and surveillance tooling. Additional reporting highlighted a broader trend of attackers abusing legitimate infrastructure and admin tooling (including **RMM** software after credential theft) to establish persistent access, while generic “common threats” content provided no incident-specific intelligence.
Jun 29, 2026
Researchers reported that **UAC-0184**—also tracked as **UNC5435** and **MB-0007**—is using spearphishing **LNK** files with Ukraine- and Cyrillic-themed lures to launch a multi-stage malware chain against Ukrainian targets. The lures invoke **`bitsadmin`** and **`mshta`** to retrieve HTA payloads from disposable infrastructure hosted on **Cloudflare Pages**, **Netlify**, and novelty TLDs, then fetch **`dctrprraclus.zip`**. The HTA stager hides malicious logic behind decoy HTML padding and embedded VBScript, which starts PowerShell to decrypt an **AES-256-CBC** base64 blob using a co-located 32-byte ASCII key and a null IV, decompress the result with gzip, and reflectively load a .NET assembly; researchers said the actor's per-sample key rotation offers little protection because the key is shipped with the ciphertext. The intrusion set now includes two signed third-party sideloading paths for the same payload family. One chain abuses legitimate **Plane9** components, progressing through **`Cluster-Overlay64.exe`**, **`Plane9Engine.dll`**, **`openvr_api.dll`**, **`kernel-diag.lib`**, and a decoded **`evr.dll`** stage that extracts **`filter.bin`**, whose pseudo-PNG **IDAT** data is XOR-decoded and **LZNT1**-decompressed into a final bundle. A parallel path uses the signed **Bitdefender Endpoint Security** deployer **`bddeploy.exe`** to sideload a malicious **`deploy.dll`** via DLL search order hijacking. The final stages include signed utilities such as Microsoft-signed **`VSLauncher.exe`** and a PassMark-derived **`input.dll`** believed to provide covert networking and possible process-dump capability, while telemetry tied to **trojan.leopard/bitsuh** and multicast or TCP traffic on **port 31339** has emerged as a consistent hunting lead.
Jun 29, 2026