Bitdefender found that attackers are still abusing MSHTA, a legacy Windows utility, to run multi-stage attack chains that deliver malware such as LummaStealer, Amatera, ClipBanker, PurpleFox, and loaders like CountLoader and Emmenhtal Loader. The campaigns rely on social engineering, fake software downloads, ClickFix-style lures, and hidden PowerShell/HTA execution to steal data, maintain persistence, and load additional payloads, while domains like google-services[.]cc, explorer[.]vg, and checking.ps1 infrastructure support the activity. #MSHTA #LummaStealer #CountLoader #EmmenhtalLoader #ClipBanker #PurpleFox
Keypoints
- MSHTA remains a widely abused Living-off-the-Land binary on Windows despite being a legacy tool.
- Attackers use MSHTA across many malware types, from commodity stealers and loaders to more persistent threats.
- Common chains involve HTA scripts, PowerShell, in-memory execution, and fileless stages to reduce on-disk artifacts.
- Social engineering is central, including fake software downloads, pirated content, and ClickFix-style clipboard lures.
- CountLoader was observed delivering LummaStealer and Amatera through domains that imitate legitimate services.
- Emmenhtal Loader used Discord phishing and fake reCAPTCHA pages to make victims paste and execute malicious commands.
- Defense recommendations include user awareness, restricting mshta.exe and wscript.exe where unnecessary, and layered security controls.
MITRE Techniques
- [T1218.005 ] System Binary Proxy Execution: Mshta – Attackers abuse mshta.exe to execute remote HTA/VBScript/JavaScript content from attacker-controlled infrastructure (‘attackers continue to abuse MSHTA’ / ‘mshta.exe appears to legitimately launch mshta.exe’).
- [T1059.005 ] Command and Scripting Interpreter: Visual Basic – VBScript is used inside HTA files and scripts to run commands and spawn other payloads (‘can execute VBScript’).
- [T1059.007 ] Command and Scripting Interpreter: JavaScript – JavaScript is embedded in HTA content to decode payloads and launch execution (‘can execute VBScript and JavaScript’).
- [T1059.001 ] Command and Scripting Interpreter: PowerShell – PowerShell is launched for hidden execution, download cradle behavior, bypassing controls, and in-memory loading (‘downloads a PowerShell script from a remote location and executes it in memory’).
- [T1027 ] Obfuscated Files or Information – Scripts and commands are heavily obfuscated with Base64, XOR, junk characters, and split tokens to hinder detection (‘heavily obfuscated’; ‘PowerShell keywords are split into multiple tokens’).
- [T1105 ] Ingress Tool Transfer – Remote HTA, PS1, MSI, and other payloads are fetched from attacker infrastructure (‘retrieve and launch a remote HTA payload’; ‘DownloadString’).
- [T1055 ] Process Injection – The article describes AM SI bypass patching and in-memory execution chains, but not classic process injection; no clear direct use beyond memory-based execution.
- [T1204.002 ] User Execution: Malicious File – Victims are tricked into downloading and running archives, HTAs, and commands copied to the clipboard (‘download software or media from untrusted websites’; ‘pressing Win + R’).
- [T1112 ] Modify Registry – The article does not explicitly mention registry changes, so this technique is not clearly evidenced.
- [T1068 ] Privilege Escalation – Not explicitly described in the article; no clear privilege escalation technique is stated.
- [T1547.001 ] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder – Scheduled tasks and persistence are mentioned, but registry run keys are not specifically detailed.
- [T1053.005 ] Scheduled Task/Job: Scheduled Task – Scheduled tasks are used to launch mshta.exe and support persistence/update workflows (‘The scheduled task names masquerade as services’).
- [T1218 ] System Binary Proxy Execution – Legitimate signed binaries are abused to execute malicious content while blending into normal activity (‘trusted, preinstalled Windows binaries’).
- [T1566 ] Phishing – Discord phishing messages and social-engineering pages are used to deliver the infection chain (‘phishing messages on Discord’).
- [T1106 ] Native API – Not specifically cited in the article; no direct evidence provided.
- [T1021 ] Remote Services – Not explicitly described as remote service abuse; not clearly supported.
- [T1564.003 ] Hide Artifacts: Hidden Window – MSHTA windows are minimized, resized to 1×1, or moved off-screen to avoid detection (‘hides the MSHTA window’).
- [T1027.013 ] Obfuscated Files or Information: Encrypted/Encoded File – Payloads are stored as Base64 or XOR-encrypted strings before execution (‘Base64-encoded string’, ‘xor_decrypt’).
Indicators of Compromise
- [SHA256 ] Malware samples and payloads – AA845A8FB4AB38AEBE6A16A2A8F80CA4467AC0991D3EEF4D8A10BDF97DEDB1E9, 1E0E375F3EE82D5AF5DFE6F7DF0E2FAC9A7D37C67ADD3390D05A93AFD85B7C84, and other hashes such as 333E2192F2551415659FB4094E81B911708921BB588EECF65E27F51C9938DFC2.
- [IP Address ] C2 and payload hosting – 185[.]208[.]159[.]199, 87[.]96[.]21[.]84, and 92[.]255[.]57[.]155 are used to host checking.ps1, further payloads, or lure content.
- [Domain ] CountLoader/LummaStealer infrastructure – google-services[.]cc, memory-scanner[.]cc, and explorer[.]vg are examples of impersonation-style domains used for loader delivery.
- [URL ] HTA and script delivery locations – hxxps[://]asd[.]s7610rir[.]pw/win/checking[.]hta, hxxps[://]buck2nd[.]oss-eu-central-1[.]aliyuncs[.]com/dir/sixth/singl6[.]mp4, and other similar lure URLs host malicious HTA or script stages.
- [File Name ] Script and payload filenames – checking.ps1, ichigo-lite.ps1, del.ps1, and 3EBCE3A4.Png are used in the delivery chain.
- [Hash ] LummaStealer payload – 1E0E375F3EE82D5AF5DFE6F7DF0E2FAC9A7D37C67ADD3390D05A93AFD85B7C84 identifies the LummaStealer assembly loaded in memory.
- [Command Line ] MSHTA/PowerShell execution chains – mshta.exe vbscript:createobject(“wscript.shell”).run(…), Start-Process powershell.exe -ArgumentList “-w hidden -ep bypass -nop -Command …”, and other one-liners show the launch logic.
Read more: https://www.bitdefender.com/en-us/blog/labs/microsofts-mshta-legacy-malware-windows