Hackers Abuse MSHTA Legacy Windows Tool to Deliver LummaStealer and Amatera Malware
Key Takeaways Cybercriminals are increasingly leveraging MSHTA, a legacy Windows utility, as a trusted component in malware delivery chains. This tactic facilitates the deployment of dangerous...
Key Takeaways
- Cybercriminals are increasingly leveraging MSHTA, a legacy Windows utility, as a trusted component in malware delivery chains.
- This tactic facilitates the deployment of dangerous malware, including LummaStealer and Amatera, leading to severe consequences such as credential theft and full system compromise.
- Bitdefender researchers have identified a significant surge in malicious MSHTA detections since early 2026, noting its use in diverse infection methods.
- The continued presence of MSHTA in Windows, despite declining legitimate use, creates a persistent attack vector that requires vigilance and proactive mitigation.
Cybersecurity researchers have uncovered a growing trend of threat actors exploiting MSHTA, a venerable Windows tool, to infiltrate systems with potent malware. This method bypasses conventional defenses by leveraging a legitimate, signed Microsoft binary, leading to outcomes ranging from stolen credentials to complete system takeover. Recent analyses specifically highlight its role in distributing LummaStealer and Amatera malware.
Table Of Content
MSHTA, an acronym for Microsoft HTML Application Host, is an integral Windows utility designed to execute scripts from both local files and remote web locations. Its inherent functionality allows it to process HTML Application (HTA) files, which are essentially HTML pages that can run scripts with the privileges of a regular application.
This built-in capability has made MSHTA a compelling target for cybercriminals, who harness its trusted status to deploy some of today’s most dangerous malware, including the notorious LummaStealer and Amatera. The core appeal for attackers lies in MSHTA’s legitimacy; as a digitally signed Microsoft binary, Windows systems inherently trust it, allowing malicious scripts executed via MSHTA to often evade detection by traditional security solutions.
Since the beginning of 2026, security teams have observed a notable increase in instances of mshta.exe within malicious infection chains. This trend is particularly alarming given that the legitimate use of MSHTA has been steadily declining, making any new detections highly suspicious.
Bitdefender researchers detailed this escalating abuse in a report, which senior software engineer Janos Gergo Szeles authored and published on May 19, 2026. Their findings indicate that MSHTA is being leveraged in a broad range of malicious activities, from deploying common password stealers to more sophisticated threats designed for long-term persistence on compromised systems.
Hackers Abuse MSHTA Legacy Windows Tool
The observed campaigns involve several prominent malware families, including LummaStealer, Amatera, ClipBanker, CountLoader, Emmenhtal Loader, and PurpleFox. In all these cases, MSHTA serves as a critical intermediate step during the initial or middle phases of the infection process. Attackers utilize MSHTA in various ways: sometimes it fetches a script directly from a command-and-control server, while in other scenarios, it acts as a link within a more complex chain involving phishing, deceptive software downloads, and social engineering techniques akin to “ClickFix” scams.
A significant concern is that MSHTA remains a default component in Windows operating systems, with no immediate plans from Microsoft for its removal. While Microsoft has announced intentions to fully disable VBScript from Windows by 2027, MSHTA itself will likely persist, leaving this attack vector open for the foreseeable future.
CountLoader: A Primary Delivery Mechanism
One of the most active attack chains identified involves a loader known as CountLoader, which uses MSHTA to deliver both LummaStealer and Amatera. The infection typically begins when a victim downloads what they believe to be legitimate free or “cracked” software. Within the downloaded archive, a file named “Setup.exe” is present. This executable is, in fact, a legitimate Python interpreter that has been bundled with malicious scripts. These scripts then covertly initiate the attack in the background.
Once the Python script executes, it calls upon a renamed copy of MSHTA, often disguised as “iso2022.exe.” This camouflaged MSHTA then establishes communication with attacker-controlled servers to retrieve the next stage of the malicious payload. Domains used in this campaign are crafted to appear trustworthy, such as “google-services[.]cc” and “memory-scanner[.]cc,” with the .cc top-level domain frequently observed. While the campaign initially peaked in late January 2026, attackers subsequently shifted their infrastructure to .vg and .gl domains, including “explorer[.]vg” and “ccleaner[.]gl.”
The ultimate payloads delivered through this chain are typically LummaStealer and Amatera. Both are designed to pilfer sensitive data, including browser credentials, session cookies, and cryptocurrency wallet information. These stealers operate stealthily, exfiltrating stolen data to cybercriminals, often without the victim’s knowledge, leading to financial losses and compromised accounts.
ClickFix Social Engineering and the Emmenhtal Loader Chain
A distinct campaign employs a different social engineering technique to trick users into executing MSHTA. Attackers send phishing messages, often via platforms like Discord, containing links to deceptive verification pages that mimic reCAPTCHA systems. When a user navigates to one of these pages, embedded JavaScript secretly copies a malicious command to the user’s clipboard. The page then prompts the user to press Win + R, paste the copied command into the Run dialog, and press Enter, effectively coaxing them into launching the attack.
This seemingly innocuous action triggers MSHTA to fetch a remote script. Crucially, this script executes entirely in memory, avoiding any writes to disk, which significantly enhances its ability to evade detection by most file-based security tools. The script itself contains multiple layers of encoding, ultimately leading to the execution of a PowerShell command that deploys LummaStealer as the final payload.
What You Should Do
- Restrict MSHTA Use: Organizations should review and, where possible, eliminate or severely restrict the use of MSHTA in administrative workflows. Block or disable
mshta.exeon endpoints where it is not explicitly required for legitimate business functions. - Implement Application Whitelisting: Employ application whitelisting solutions to prevent unauthorized executables, including renamed system binaries like MSHTA, from running.
- Enhance Endpoint Detection and Response (EDR): Utilize advanced EDR solutions capable of behavioral detection and runtime blocking to identify and neutralize malicious activity, even when leveraging legitimate tools or executing in memory.
- Strengthen Email and Messaging Security: Implement robust email and messaging security gateways to filter out phishing attempts that lead to malicious downloads or social engineering traps.
- User Education and Awareness: Conduct regular cybersecurity training for all users, emphasizing the dangers of downloading unofficial software, clicking suspicious links, and executing commands from unknown sources, especially those prompting for “verification” or “fixes.”
- Monitor Network Traffic: Continuously monitor network traffic for suspicious connections to unusual domains or IP addresses, particularly those associated with known malware command-and-control infrastructure.
- Indicators of Compromise (IoCs) Integration: Integrate the provided IoCs (SHA256 hashes, URLs, and domains) into your security information and event management (SIEM) systems, firewalls, and endpoint protection platforms to detect and block known threats.
Indicators of Compromise (IoCs):
Emmenhtal Loader
| Type | Indicator | Description |
|---|---|---|
| SHA256 | AA845A8FB4AB38AEBE6A16A2A8F80CA4467AC0991D3EEF4D8A10BDF97DEDB1E9 | Initial HTA launched after ClickFix |
| SHA256 | 02630FA994B1566AD1515FD87220FC037B967F07495985A3637D68D7E08C57EE | Obfuscated PowerShell |
| SHA256 | 1E0E375F3EE82D5AF5DFE6F7DF0E2FAC9A7D37C67ADD3390D05A93AFD85B7C84 | LummaStealer payload |
| URL | hxxp[://]185[.]147[.]124[.]40/Capcha[.]html | Emmenhtal URL |
| URL | hxxp[://]92[.]255[.]57[.]155/Capcha[.]html | Emmenhtal URL |
| URL | hxxps[://]denek[.]local-wanderer[.]shop/RIWZ[.]mp4 | Emmenhtal URL |
| URL | hxxps[://]buck2nd[.]oss-eu-central-1[.]aliyuncs[.]com/dir/sixth/singl6[.]mp4 | Emmenhtal URL |
| URL | hxxps[://]macphotoeditor[.]shop/singl5[.]mp4 | Emmenhtal URL |
| URL | hxxps[://]topofsuper[.]shop/re5[.]mp4 | Emmenhtal URL |
| URL | hxxps[://]antibot-check[.]icu/Capcha[.]html | Emmenhtal URL |
| URL | hxxps[://]checkpageonce[.]com/singl6[.]mp4 | Emmenhtal URL |
| URL | hxxps[://]echoicedeals[.]shop/s6[.]mp3 | Emmenhtal URL |
| URL | hxxps[://]kizmond[.]shop/riiw1[.]mp4 | Emmenhtal URL |
| URL | hxxps[://]klipjaqemiu[.]shop/web44[.]mp4 | Emmenhtal URL |
| URL | hxxps[://]macphotoeditor[.]shop/singl6[.]mp4 | Emmenhtal URL |
| URL | hxxps[://]onceletthemcheck[.]com/singl5[.]mp4 | Emmenhtal URL |
| URL | hxxps[://]pawpaws[.]readit-carfanatics[.]com/madonna[.]mp4 | Emmenhtal URL |
| URL | hxxps[://]propofgustestyle[.]info/recaptcha-verify[.]html | Emmenhtal URL |
| URL | hxxps[://]recaptcha-process[.]com/recaptcha-verify[.]html | Emmenhtal URL |
| URL | hxxps[://]retrosome[.]shop/ru2-2[.]eml | Emmenhtal URL |
| URL | hxxps[://]savecoupons[.]store/s7[.]mp4 | Emmenhtal URL |
| URL | hxxps[://]solve[.]gevaq[.]com/awjxs[.]captcha?u=a1bdaa0d-6aab-4d96-bafe-483ef5eb8cae | Emmenhtal URL |
| URL | hxxps[://]solve[.]jenj[.]
Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.
|
No Comment! Be the first one.