New Phishing Campaign Abuses Windows Mshta.exe to Steal Credentials and Secrets
Fortra researchers track an active phishing campaign targeting Spanish speakers that abuses mshta.exe to run HTA payloads for reconnaissance and credential theft.
Fortra's FIRE team says a phishing campaign active since June 2026 targets Spanish-speaking users with invoice ('Facturación') and judicial ('Aviso Judicial') lures, many sent via libero.it/italiaonline.it infrastructure with SCL:-1 markings to bypass anti-spam. Clicking embedded links delivers an HTA launcher executed via mshta.exe, which hides its window off-screen, builds dynamic C2 URLs, and performs reconnaissance using WMI, PowerShell, and environment-variable inspection. A second-stage JavaScript dropper uses HTML smuggling to reconstruct a Base64-encoded ZIP in the browser, delivering a 7-Zip self-extracting executable disguised as a Firefox installer; staged design allows later delivery of credential stealers or ransomware. Defenders are urged to block archivogratuito[.]online and shortener domains goo[.]su, abrir[.]link, and abre[.]ai, and to restrict mshta.exe execution via AppLocker or ASR rules.
- Campaign active since June 2026, targeting Spanish-speaking users with 'Facturación' invoice and 'Aviso Judicial' lures.
- Emails from libero.it/italiaonline.it senders carried SCL:-1 markings, letting them bypass standard anti-spam processing.
- HTA payload hides off-screen via window.moveTo(6823, 3940) and performs recon with WMI, PowerShell, and environment variables.
- JavaScript HTML smuggling drops a 7-Zip SFX executable disguised as a Firefox installer from a Base64 ZIP.
- Operators regularly recompile samples to change hashes; infrastructure reused from Portuguese-language campaigns ('Redirecionamento').
- ATT&CK
- T1566.002 Spearphishing LinkT1204.002 User Execution: Malicious FileT1218.005 MshtaT1047 Windows Management InstrumentationT1082 System Information Discovery
- Products
- mshta.exe
- Organizations
- Fortra FIRElibero.itItaliaonlineGoDaddy
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | abre.ai | shortening services including goo[.]su , abrir[.]link , and abre[.]ai . Teams should also investigate suspicious traffic involv |
| domain | abrir.link | to associated URL-shortening services including goo[.]su , abrir[.]link , and abre[.]ai . Teams should also investigate suspiciou |
| domain | archivogratuito.online | g the victim environment. Mitigation Defenders should block archivogratuito[.]online and monitor or restrict traffic to associated URL-shorten |
| domain | goo.su | ict traffic to associated URL-shortening services including goo[.]su , abrir[.]link , and abre[.]ai . Teams should also invest |
From the original article
3 min read at gbhackers.com
A newly identified phishing campaign is abusing the legitimate Windows utility mshta. exe to execute malicious HTML Application (HTA) files, conduct system reconnaissance, and potentially deploy payloads designed to steal credentials and local secrets. Fortra’s Intelligence and Research Experts (FIRE) said the activity began in June and remains active, with operators regularly recompiling malware samples to […]
By Eswar · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.