Reported by 2 outlets

Timeline

1. original reporting

   Phishing Campaign Abuses Windows Mshta.exe to Steal Credentials and Secrets

   gbhackers.com · 31d ago · September 12th, 2026

   A newly identified phishing campaign is abusing the legitimate Windows utility mshta.exe to execute malicious HTML Application (HTA) files, conduct system reconnaissance, and potentially deploy payloads designed to steal credentials and local secrets. Fortra’s Intelligence and Research Experts (FIRE) said the activity began in June and remains active, with operators regularly recompiling malware samples to […] The post New Phishing Campaign Abuses Windows Mshta.exe to Steal Credentials and Secrets appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from cyberpress.org

   Hackers Abuse Windows Mshta.exe in Phishing Attacks to Deploy HTA Malware and Steal Credentials

   cyberpress.org · 31d ago · September 12th, 2026

   Threat actors are actively abusing the legitimate Windows utility mshta.exe to execute malicious HTML Application (HTA) files delivered through Spanish-language phishing emails, enabling system reconnaissance and the staged deployment of credential-stealing malware. Researchers at Fortra’s Intelligence and Research Experts (FIRE) have tracked the campaign since June. It primarily targets Spanish-speaking users at global organizations through fake invoice and judicial-notice lures, including emails titled around Facturación and Aviso Judicial . The messages originate largely from accounts hosted by Italian provider libero.it, using italiaonline.it infrastructure. A notable element of the campaign is the apparent abuse of an email spam-confidence-level bypass. Hackers Abuse Windows Mshta.exe in Phishing Attacks Messages categorized as high-confidence phishing reportedly received an SCL:-1 value, allowing them to reach recipients’ inboxes rather than being quarantined by Microsoft email defenses. The attack begins when a victim clicks a shortened URL embedded in the phishing email. The links redirect through services including goo[.]su , abrir[.]link , and abre[.]ai before leading to a malicious delivery page hosted through archivogratuito[.]online . Victims are ultimately prompted to open an HTA file, such as Doc_02º.HTA . When launched, the file is handled by mshta.exe , a signed Microsoft binary designed to execute HTML Applications. Because mshta.exe is installed on many Win

3. update from cyberpress.org

   Attackers Chain Mshta.exe, HTA Files, and HTML Smuggling https:// cyberpress.org/hackers-abuse- windows-mshta-exe-in-phishing-attacks/ … A p

   cyberpress.org · 29d ago · September 14th, 2026

   Attackers Chain Mshta.exe, HTA Files, and HTML Smuggling https:// cyberpress.org/hackers-abuse- windows-mshta-exe-in-phishing-attacks/ … A p

   via X https://cyberpress.org/hackers-abuse-windows-mshta-exe-in-phishing-attacks/