Hackers Abuse Windows Mshta.exe in Phishing Attacks to Deploy HTA Malware and Steal Credentials

Threat actors are actively abusing the legitimate Windows utility mshta.exe to execute malicious HTML Application (HTA) files delivered through Spanish-language phishing emails, enabling system reconnaissance and the staged deployment of credential-stealing malware. Researchers at Fortra’s Intelligence and Research Experts (FIRE) have tracked the campaign since June. It primarily targets Spanish-speaking users at global organizations through fake invoice and judicial-notice…

Diamond Model