Hackers Abuse MSHTA Legacy Windows Tool to Deliver LummaStealer and Amatera Malware

Hackers are exploiting a decades-old Windows tool to deliver dangerous malware onto unsuspecting systems, with consequences ranging from stolen passwords to full system compromise.

The tool is MSHTA, short for Microsoft HTML Application Host, a built-in Windows utility that can run scripts from local files and remote internet locations.

Attackers have been using it to deliver some of today’s most harmful malware, including LummaStealer and Amatera.

What makes MSHTA attractive to cybercriminals is its legitimacy. It is a signed Microsoft binary, meaning Windows trusts it by default, and that built-in trust is exactly what attackers exploit.

Since the start of 2026, security teams have noticed a sharp rise in detections of mshta.exe in malicious infection chains. The fact that legitimate use of this tool is steadily declining makes the trend even more telling.

Researchers at Bitdefender identified the growing abuse and traced multiple active campaigns relying on MSHTA.

Bitdefender said in a report shared with Cyber Security News (CSN) that the activity spans a wide spectrum, from everyday password stealers to advanced threats capable of hiding on infected systems for long periods.

The research was authored by senior software engineer Janos Gergo Szeles and published on May 19, 2026.

Hackers Abuse MSHTA Legacy Windows Tool

The campaigns observed cover several malware families, including LummaStealer, Amatera, ClipBanker, CountLoader, Emmenhtal Loader, and PurpleFox.

All use MSHTA as a stepping stone during early or middle stages of infection. In some cases, MSHTA pulls a script from an attacker-controlled server, while in others it sits inside a longer chain involving phishing, fake software downloads, and ClickFix-style social engineering tricks.

What makes the situation particularly serious is that MSHTA remains on Windows by default with no announced removal timeline. While Microsoft plans to fully disable VBScript from Windows by 2027, MSHTA stays an open door for attackers for the foreseeable future.

One of the most active attack chains involves a loader called CountLoader, which uses MSHTA to deliver LummaStealer and Amatera.

The infection starts when a victim downloads what appears to be free or cracked software. Inside the archive is a file called Setup.exe, which is actually a legitimate Python interpreter bundled with malicious scripts that quietly launch the attack in the background.

As the Python script runs, it uses a renamed MSHTA copy disguised as iso2022.exe to connect to attacker servers and fetch the next-stage payload.

Domains used in this campaign look like trusted services, such as google-services[.]cc and memory-scanner[.]cc, with the .cc top-level domain appearing repeatedly.

The campaign peaked at the end of January 2026 before attackers shifted to .vg and .gl domains, including explorer[.]vg and ccleaner[.]gl.

The final payload is most often LummaStealer, designed to harvest browser credentials, session cookies, and cryptocurrency wallet data.

Amatera, another stealer in the same chain, targets similar data. Both can silently drain accounts and pass stolen information to criminals, often while victims remain completely unaware.

ClickFix Social Engineering and the Emmenhtal Loader Chain

A separate campaign uses a different trick to get MSHTA running on victim machines. Attackers send phishing messages on Discord linking to fake verification pages disguised as reCAPTCHA systems.

When a user visits one of these pages, JavaScript secretly copies a malicious command to the clipboard and instructs them to press Win + R, paste it, and hit Enter.

That single action triggers MSHTA to fetch a remote script that runs entirely in memory, never touching the disk, helping it evade most file-based security tools.

Inside are multiple encoded layers that eventually execute a PowerShell command, dropping LummaStealer as the final payload.

Bitdefender recommends organizations move away from MSHTA in administrative workflows wherever possible and restrict or block binaries like mshta.exe where no longer needed.

User education matters just as much, given how heavily these campaigns rely on tricking people into running commands they do not fully understand.

A layered defense covering behavioral detection and runtime blocking remains the most effective way to stop these attacks before lasting damage is done.

Indicators of Compromise (IoCs):–

Emmenhtal Loader

CountLoader / LummaStealer Domains

ClipBanker

PurpleFox

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.