Phishing operation exploits Windows Mshta for credential theft

A phishing campaign targeting Spanish-speaking users of global organizations began in June, utilizing Microsoft's legitimate mshta.exe utility to distribute malicious HTML Application files. Security researchers, Fortra Intelligence and Research Experts (FIRE), discovered the ongoing operation primarily employs Spanish-language lures such as invoice and judicial-notice emails to deceive recipients.

The phishing messages, originating from Italian free-email service libero.it or Microsoft 365 infrastructure, guide victims through URL-shortening services to a page that downloads an HTA file. Upon opening the file, Windows invokes mshta.exe, a trusted Windows binary capable of executing HTA files, JavaScript, and VBScript. The malicious HTA loads remote JavaScript, causing the activity to appear hidden from the user.

The second stage of the attack gathers system information using Windows Management Instrumentation, PowerShell, and environment variables to determine subsequent payload deployment. The JavaScript stage then constructs a Base64-encoded ZIP archive through HTML smuggling, which contains a 7-Zip self-extracting executable disguised as a Firefox installer.

Upon execution, the payload extracts and launches the next stage from a temporary directory, with the goal of stealing local secrets. The campaign employs various evasion tactics, including random file names, off-screen HTA execution, embedded Base64 content, and polymorphic executables, making static hash-based blocking ineffective.

FIRE advises defenders to monitor mshta.exe running from user-writable locations, restrict its usage, and examine mail-flow rules for suspicious activity.