Phishing operation exploits Windows Mshta for credential theft

A phishing operation, active since June, has been exploiting Microsoft's legitimate mshta.exe utility to carry out credential theft and deliver malware, according to security researchers. The campaign primarily targets Spanish-speaking users at global organizations. The attackers use Spanish-language lures, such as fake invoices and judicial notices, to trick recipients into following malicious links.

The attack begins with phishing messages from Italian free-email service libero.it or Microsoft 365 infrastructure. Victims are directed through URL-shortening services to download an HTA file, which is executed by the Windows mshta.exe utility. This allows the malware to run hidden and load remote JavaScript, avoiding user detection.

The second stage gathers system information using Windows Management Instrumentation, PowerShell, and environment variables. The malicious JavaScript then decodes a Base64-encoded ZIP archive through HTML smuggling, distributing a 7-Zip self-extracting executable disguised as a Firefox installer. Once executed, it extracts and launches the final payload from a temporary directory.

The campaign's primary objective is to steal local secrets through an information stealer, although it can support other payloads. To complicate detection, the attackers use random file names, off-screen HTA execution, embedded Base64 content, and polymorphic executables with varying hashes. The campaign is notable for its consistent Spanish-language elements in emails, social-engineering text, and source code.

Experts recommend monitoring mshta.exe command lines referencing suspicious content and restricting its use when not necessary. Disabling or restricting mshta.exe can help prevent exploitation of this vulnerability.