Loading story…
Researchers warned that T4 text template files (.tt) can be abused to execute attacker-controlled code because the files may embed C# or Visual Basic that is compiled and run by trusted developer tooling. The reported execution paths include TextTransform.exe, TextTransformCore.exe, t4.exe, and MSBuild.exe, allowing malicious templates to run on developer workstations under the guise of normal build activity.
The reporting said the risk extends beyond local abuse to software supply-chain tampering, particularly when attackers modify project files or templates that are later merged into build pipelines. One highlighted technique uses a changed .csproj file to import Microsoft.TextTemplating.targets so a malicious .tt file is invoked during builds, while defenders were urged to monitor process creation for the relevant binaries and treat unexpected .tt files as suspicious unless there is a clear legitimate development need.
Trace attribution and downstream blast radius.
2 events from the most recent confirmed update back to the earliest known activity.
A Reddit post on r/netsec shared the research on code execution via text template files, warning that attackers could create or modify .tt files to run code in trusted developer processes or tamper with templates merged into build pipelines. The post linked readers to the playbook and detection guidance.
A Purple Team research article described how T4 text template files (.tt) can be abused for code execution through TextTransform.exe, TextTransformCore.exe, t4.exe, and MSBuild.exe, including local developer workstation and software supply-chain scenarios. The article also published detection guidance focused on process creation, file creation, and image-load telemetry for these execution paths.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that developer tooling can execute code from a project **before a user writes code or starts a build**, extending long-standing supply-chain concerns from package restore and project evaluation into newer coding-agent workflows. Datadog Security Labs described pre-prompt execution paths in trusted coding-agent projects, while separate research on NuGet and MSBuild showed that opening a repository or restoring dependencies can invoke `.targets` or `.props` logic and arbitrary commands through MSBuild's `Exec` task during project evaluation. The combined findings highlight a risk path in which a cloned or otherwise trusted repository can trigger automation in IDEs, agents, or CI/CD environments and expose sensitive credentials, tokens, and build secrets. Researchers noted that Visual Studio applies **Mark of the Web** warnings to downloaded files but not necessarily to repositories obtained via `git clone`, leaving a gap where malicious project metadata or package content may run without equivalent trust prompts; community discussion emphasized isolating untrusted projects in disposable VMs or tightly scoped rootless containers as a baseline mitigation.
Aug 4, 2026
Threat researchers documented multiple campaigns abusing Microsoft Build Engine (**MSBuild.exe**) as a living-off-the-land binary to compile and execute malicious code in memory, helping attackers bypass application controls and reduce disk artifacts. Cisco Talos reviewed more than 100 suspicious MSBuild project files and found frequent use of inline tasks to launch post-exploitation tooling such as **Cobalt Strike**, **Meterpreter**, **Covenant**, **Silent Trinity**, and **Mimikatz**, often after initial access from Office macros, HTA files, or browser-driven delivery chains. MITRE maps this behavior to technique `T1127`, reflecting the use of trusted developer utilities for defense evasion and execution. The same tradecraft appeared across distinct intrusion sets and malware families. Zscaler described a targeted campaign in which macro-enabled Word documents wrote obfuscated C# code to disk and used **csc.exe** and **MSBuild.exe** to compile and deploy the previously unreported **ShellReset** RAT, which supported remote shell access, file transfer, directory listing, and screenshot capture. AhnLab reported attackers compromising exposed Microsoft SQL Server instances and then launching **MSBuild.exe** to inject a **Cobalt Strike** beacon into `wwanmm.dll`, while QiAnXin linked a Kashmir-themed campaign to **APT-C-09**, which used a fake `MSBuild.exe` in `%AppData%` alongside GitHub and Feed43 dead-drop resolvers for command-and-control. Across the reporting, defenders were urged to prioritize detections for unusual parent-child process chains, especially Office applications, browsers, or SQL Server processes spawning **MSBuild.exe**.
Aug 15, 2026
Bitdefender warned that attackers are increasingly abusing Microsoft’s legacy `mshta.exe` utility as a living-off-the-land tool to execute remote or in-memory scripts and deliver malware including **LummaStealer**, **Amatera**, **CountLoader**, **Emmenhtal Loader**, **ClipBanker**, and **PurpleFox**. The campaigns rely on phishing, fake software downloads, SEO poisoning, cracked-software lures, fake social media posts, Discord messages, and ClickFix-style fake CAPTCHA or reCAPTCHA prompts that trick users into launching malicious commands. Researchers said much of the observed `mshta.exe` traffic was tied to typosquatted or attacker-controlled domains masquerading as legitimate services, with payloads focused on credential theft, session cookie theft, cryptocurrency wallet theft, and persistent compromise. One highlighted infection chain used a fake `Setup.exe` containing a bundled Python interpreter and a renamed MSHTA binary to retrieve additional payloads, while other chains used fileless execution through PowerShell, WScript, HTA content, and even `msiexec` to fetch disguised installer packages. Bitdefender said legitimate enterprise use of MSHTA is declining while malicious use is rising, and noted that although VBScript was deprecated in 2024 and is expected to be disabled by default in 2027, Microsoft has not indicated plans to remove MSHTA. The company urged defenders to disable or restrict `mshta.exe` and `wscript.exe` where possible, migrate away from legacy scripts, improve user awareness, and rely on layered behavioral and runtime defenses.
Jun 29, 2026