'This reveals a broader security problem': Experts warn a key Microsoft legacy tool is still being abused to…
- Bitdefender reports rising abuse of the legacy MSHTA utility to deliver infostealers and loader malware
- Campaigns range from simple commodity threats like LummaStealer to advanced persistence tools such as PurpleFox
- Defenders are urged to restrict outdated scripting utilities and deploy layered security controls to detect malicious script activity
Cybercriminals are increasingly using a legitimate legacy Windows tool to deploy infostealers and loader malware, researchers are saying.
A new Bitdefender report has claimed that since the start of 2026, there’s been an uptick in activity related to a Windows utility called Microsoft HTML Application Host (MSHTA), a legitimate utility that runs special HTML-based application files known as HTAs.
While normal web pages get opened in a browser, HTA files interact directly with the Windows operating system and can execute scripts with elevated privileges.
Simple and complex threats
MSHTA is an old tool that was originally designed for lightweight desktop and administrative...
Copyright of this story solely belongs to techradar.com. To see the full text click HERE
