Bitdefender Reports Rise in Malware Campaigns Abusing MSHTA
Summary
Bitdefender reports increased threat-actor use of MSHTA to deliver malware, including Lumma, Amatera, ClipBanker and PurpleFox. The article describes social-engineering tactics and recommends user training and restricting legacy binaries.
Key points
- Bitdefender detected a rise in MSHTA-related activity and attributes it to increased threat-actor use rather than renewed administrative adoption.
- MSHTA can execute remote HTA content, allowing malicious scripts to run in memory under a trusted, Microsoft-signed utility.
- CountLoader campaigns have used lures such as cracked software to deliver Lumma and Amatera stealers.
- An Emmenhtal campaign used Discord phishing and a fake verification prompt to trick victims into pasting and executing a command that launched MSHTA.
- Other reported campaigns used MSHTA to deliver ClipBanker and PurpleFox.
- The article recommends user-awareness training, restricting access to legacy binaries where possible, and protections across the attack chain.
Article Details
- Event Type
- Reported increase in the abuse of MSHTA, a built-in Windows utility, to deliver malware through social engineering and multi-stage infection chains.
- Impact
- Bitdefender reported a dramatic rise in MSHTA-related activity since the start of the year and attributed it to increased threat actor use rather than renewed administrative adoption. The described campaigns delivered Lumma, Amatera, other stealers, ClipBanker, and PurpleFox. The article gives no victim count or quantified losses.
MITRE ATT&CK
T1059.001 · PowerShellThe article describes PowerShell scripts being downloaded and run in memory during MSHTA-driven infection chains.T1105 · Ingress Tool TransferThe described chains download remote HTA content, scripts, and malware payloads.T1115 · Clipboard DataClipBanker is described as replacing cryptocurrency wallet addresses in the clipboard.T1204.002 · Malicious FileIn a Lumma campaign, victims were tricked into executing a setup file that was actually a Python interpreter.T1204.004 · Malicious Copy and PasteIn an Emmenhtal campaign, victims were tricked into pasting and executing a malicious command as part of a fake human-verification process.T1218.005 · MshtaAttackers abuse MSHTA, a trusted Windows binary, to retrieve and execute remote HTA or script content.
People
Malware
Amatera StealerOne common abuse of MSHTA detected by Bitdefender involved the use of the HTA CountLoader to deliver the Lumma and Amatera stealers.ClipBankerOther MSHTA-driven campaigns have included the delivery of ClipBanker and PurpleFox.CountLoaderOne common abuse of MSHTA detected by Bitdefender involved the use of the HTA CountLoader to deliver the Lumma and Amatera stealers.EmmenhtalThe Emmenhtal loader was also observed in delivering Lumma and other stealers.LummaOne common abuse of MSHTA detected by Bitdefender involved the use of the HTA CountLoader to deliver the Lumma and Amatera stealers.PurpleFoxof malware – ranging from commodity stealers and loaders to advanced and persistent malware such as PurpleFox.
Vendors
Products
EdgeIt also continues to run with the Edge browser through the IE mode.Internet ExplorerMSHTA (Microsoft HTML Application) has been a part of Windows since 1999 and the release of Win98 SE and Internet Explorer 5.0.Microsoft WindowsMSHTA (Microsoft HTML Application) has been a part of Windows since 1999 and the release of Win98 SE and Internet Explorer 5.0.
Tools
Explorer.exeIf the user is subsequently further tricked into pressing Win + R to open the Run dialog, followed by Ctrl + V and Enter to paste and execute the command, then explorer.exe seems to legitimately launch MSHTA.mshta.exeMSHTA is an example.msiexec“One of its long-standing delivery methods, however, has remained consistent: launching msiexec from an MSHTA command line in order to download and execute an MSI package disguised as a .png file,” says Bitdefender.PowerShellUltimately, a PowerShell script is downloaded from a remote location and runs in memory without saving the script to disk.