Legacy Windows Tool MSHTA Fuels Surge in Silent Malware Attacks
Good intentions can have unintended consequences. MSHTA is an example.
MSHTA (Microsoft HTML Application) has been a part of Windows since 1999 and the release of Win98 SE and Internet Explorer 5.0. It has remained part of Windows throughout, including the latest current releases. It also continues to run with the Edge browser through the IE mode. The purpose is to conform to Microsoft’s policy of prioritizing backward compatibility.
Over the years, legitimate use of MSHTA has declined. Abuse, however, has grown. MSHTA is increasingly used by bad actors as a Living-off-the-Land binary (LOLBIN) to silently deliver a growing range of malware – ranging from commodity stealers and loaders to advanced and persistent malware such as PurpleFox.
Since the start of this year, BitDefender has detected a dramatic rise in MSHTA-related activity. The firm believes this reflects increased threat actor use rather than renewed administrative adoption.
MSHTA
MSHTA is...
Copyright of this story solely belongs to securityweek.com. To see the full text click HERE
