CTI · corroborated · 2026-09-12

Phishing Campaign Abuses Windows Mshta.exe to Steal Credentials and Secrets

Full story & timeline

MITRE ATT&CK

• T1566 Phishing Initial Access
• T1170 Mshta Stealth
• T1059 Command and Scripting Interpreter Execution
• T1555 Credentials from Password Stores Credential Access

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Mshta.exe Phishing Campaign Credential Theft via HTA Files
id: b8c9d0e1-f2a3-4567-bcde-678901234567
status: experimental
description: Detects phishing campaigns abusing mshta.exe to execute HTA files for credential theft
references:
  - https://www.gbhackers.com/
  - https://cyberpress.org/
author: Tia N. List
date: 2026-09-12
tags:
  - attack.initial-access
  - attack.t1566
  - attack.stealth
  - attack.t1170
logsource:
  product: windows
  category: process_creation
detection:
  selection_mshta_execution:
    Image|endswith:
      - '\mshta.exe'
    CommandLine|contains:
      - '.hta'
      - 'vbscript'
      - 'jscript'
      - 'http'
  selection_mshta_from_email:
    ParentImage|endswith:
      - '\outlook.exe'
      - '\thunderbird.exe'
      - '\winmail.exe'
    Image|endswith:
      - '\mshta.exe'
  selection_mshta_suspicious:
    Image|endswith:
      - '\mshta.exe'
    CommandLine|contains:
      - 'javascript'
      - 'VBScript'
      - 'Execute'
      - 'CreateObject'
      - 'WScript.Shell'
  condition: selection_mshta_execution or selection_mshta_from_email or selection_mshta_suspicious
falsepositives:
  - Legitimate HTA application usage
level: high

References

• https://www.gbhackers.com/
• https://cyberpress.org/