A new phishing campaign has emerged, utilizing the legitimate Windows utility mshta.exe to execute malicious HTML Application (HTA) files. This nefarious operation not only facilitates system reconnaissance but also poses the potential threat of deploying payloads aimed at stealing user credentials and local secrets. Fortra’s Intelligence and Research Experts (FIRE) recently reported that this activity began in June and continues to remain active. The operators behind this campaign are reportedly recompiling malware samples regularly, generating new hashes to effectively circumvent signature-based security measures.
The phishing campaign uniquely targets Spanish-speaking users and organizations. It employs localized social-engineering strategies to create a deceptive narrative, making use of a multi-stage delivery mechanism that is designed to elude both email filtering systems and endpoint defenses. Such tactics indicate a sophisticated understanding of how to trick users into clicking on malicious links.
Phishing Techniques and Lures
The operation chiefly relies on spear-phishing emails masquerading as invoices, leveraging themes like “Facturación” and judicial notifications dubbed “Aviso Judicial.” These emails are tactically crafted to instill a sense of urgency that entices recipients to click on embedded links without a second thought. It has been noted that many of these emails originated from the Italian free-email provider libero.it, which is interconnected with the infrastructure of italiaonline.it.
In a concerning development, some emails were marked with an SCL:-1 spam-confidence setting, a factor that allowed them to bypass standard anti-spam filters. This capability enabled potentially harmful content to reach users’ inboxes while still being categorized as high-confidence phishing attacks. This practice signals a grave complication for cybersecurity protocols, as it introduces sophisticated ways for malicious content to infiltrate secure environments.
While Spanish remains consistent throughout the emails, web content, source-code comments, and user-interface text, there are also signs of Portuguese-language artifacts in the intermediate pages. One page notably featured the title “Redirecionamento,” implying that attackers may be reusing resources or templates from previous campaigns aimed at Portuguese-speaking victims.
Once a target clicks on a phishing link, the delivery mechanism activates, and an HTA launcher identified as Doc_02º.HTA is provided. Upon execution, this file is opened via mshta.exe, a legitimate Microsoft binary capable of running HTML and script content with extensive local system access.
Tactics to Avoid Detection
The HTA payload employs sophisticated tactics to conceal its activities. By moving the application window beyond the bounds of a normal monitor—via the command window.moveTo(6823, 3940)—the malware reduces the chances that users will notice any suspicious activity. This stealthy maneuver is just one of many designed to obfuscate the malicious intent behind the operation.
Subsequently, the malware dynamically constructs a command-and-control (C2) URL, injecting a remote script into the HTML page, complicating static URL detection efforts. It then conducts reconnaissance using Windows Management Instrumentation (WMI) queries, PowerShell, and by inspecting environment variables. This information-gathering process allows attackers to assess the system’s value before deciding on the subsequent payload to deliver.
A second-stage JavaScript dropper utilizes HTML smuggling to digitally reconstruct a Base64-encoded ZIP archive directly within the browser. It employs functions like atob() and Uint8Array to decode the content, forcing the archive download through an invisible anchor element and a programmatic click, all while deceiving the user with Spanish-language messages like “Descarga Iniciada” and “Procesando descarga…”.
The archive itself is a 7-Zip self-extracting executable disguised as a Firefox installer. Once executed, it extracts a payload into a temporary directory and subsequently launches it via Windows process execution functionalities. Although the initial executable appears to serve primarily as an extractor and dropper, the campaign’s multi-layered design affords operators the flexibility to deliver various types of malware, such as credential stealers, ransomware, or other harmful software, depending on the assessment of the compromised system.
Mitigation Strategies
In light of these threats, cybersecurity experts advise organizations to block specific URLs like archivogratuito[.]online and monitor traffic involving associated URL-shortening services such as goo[.]su, abrir[.]link, and abre[.]ai. Investigating suspicious traffic linked to GoDaddy-hosted servers is also recommended.
Additionally, organizations are urged to monitor for instances of mshta.exe being executed from user-writable locations like Downloads, Desktop, and AppData. Employing AppLocker, Windows Defender Application Control, or Attack Surface Reduction rules could effectively disrupt the infection chain, potentially halting reconnaissance and preventing credential theft.
As phishing scams continue to evolve in sophistication and reach, it is imperative for security operations centers (SOCs) to stay up-to-date on active malware and phishing developments, ensuring early detection and decisive intervention in preventing potential incidents.