New Phishing Campaign Abuses Windows Mshta.exe to Steal Credentials and Secrets

A newly identified phishing campaign is abusing the legitimate Windows utility mshta.exe to execute malicious HTML Application (HTA) files, conduct system reconnaissance, and potentially deploy payloads designed to steal credentials and local secrets.

Fortra’s Intelligence and Research Experts (FIRE) said the activity began in June and remains active, with operators regularly recompiling malware samples to generate new hashes and evade signature-based security controls.

The campaign primarily targets Spanish-speaking users and organizations, using localized social-engineering content and a multi-stage delivery chain intended to bypass email filtering and endpoint defenses.

New Phishing Campaign Abuses Windows Mshta.exe

The phishing operation relies on convincing Spanish-language emails disguised as invoices, using “Facturación” themes, and judicial notifications labeled “Aviso Judicial.” These lures are designed to create urgency and persuade recipients to click embedded malicious links.

Fortra found that many messages originated from the Italian free-email provider libero.it, which is associated with italiaonline.it infrastructure.

Several observed emails were marked with an SCL:-1 spam-confidence setting, allowing them to bypass standard anti-spam processing and reach user inboxes despite being categorized as high-confidence phishing content.

While Spanish is used consistently throughout the malicious emails, web content, source-code comments, and user-interface text, intermediate pages also contained Portuguese-language artifacts.

One page used the title “Redirecionamento,” suggesting the attackers may be reusing infrastructure or templates associated with campaigns aimed at Portuguese-speaking victims.

After a target clicks a phishing link, the delivery chain provides an HTA launcher, including a sample identified as Doc_02º.HTA. Windows opens this file through mshta.exe, a legitimate Microsoft binary that can execute HTML and script content with extensive access to the local system.

The HTA payload hides its activity by moving its application window beyond normal monitor boundaries with window.moveTo(6823, 3940). This off-screen technique reduces the likelihood that users will see a suspicious window appear during execution.

The script then dynamically constructs a command-and-control URL and injects a remote script into the HTML page, making static URL detection more difficult.

The malware subsequently performs reconnaissance using WMI queries, PowerShell, and environment-variable inspection. It gathers information about the operating system, BIOS, usernames, and local configuration.

This intelligence can help attackers decide which payload to deliver next and whether a compromised device is valuable enough to escalate.

A second-stage JavaScript dropper uses HTML smuggling to reconstruct a Base64-encoded ZIP archive directly in the browser. The script uses atob() and Uint8Array functions to decode the embedded content, then forces the archive download through an invisible anchor element and a programmatic click action.

Spanish-language messages such as “Descarga Iniciada” and “Procesando descarga…” make the download appear legitimate. The resulting archive contains a 7-Zip self-extracting executable disguised as a Firefox installer.

The executable extracts a payload into a temporary directory and launches it through Windows process-execution functions.

Although the observed executable appears to function mainly as an extractor and dropper, the campaign’s staged design provides operators with flexibility to deliver credential stealers, ransomware, or other malware after profiling the victim environment.

Mitigation

Defenders should block archivogratuito[.]online and monitor or restrict traffic to associated URL-shortening services including goo[.]su, abrir[.]link, and abre[.]ai. Teams should also investigate suspicious traffic involving the identified GoDaddy-hosted delivery servers.

Organizations should monitor for mshta.exe executing from user-writable locations such as Downloads, Desktop, and AppData. Restricting mshta.exe through AppLocker, Windows Defender Application Control, or Attack Surface Reduction rules can interrupt the infection chain before reconnaissance and credential theft occur.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.