Threat actors are actively abusing the legitimate Windows utility mshta.exe to execute malicious HTML Application (HTA) files delivered through Spanish-language phishing emails, enabling system reconnaissance and the staged deployment of credential-stealing malware.
Researchers at Fortra’s Intelligence and Research Experts (FIRE) have tracked the campaign since June. It primarily targets Spanish-speaking users at global organizations through fake invoice and judicial-notice lures, including emails titled around Facturación and Aviso Judicial.
The messages originate largely from accounts hosted by Italian provider libero.it, using italiaonline.it infrastructure. A notable element of the campaign is the apparent abuse of an email spam-confidence-level bypass.
Hackers Abuse Windows Mshta.exe in Phishing Attacks
Messages categorized as high-confidence phishing reportedly received an SCL:-1 value, allowing them to reach recipients’ inboxes rather than being quarantined by Microsoft email defenses.
The attack begins when a victim clicks a shortened URL embedded in the phishing email. The links redirect through services including goo[.]su, abrir[.]link, and abre[.]ai before leading to a malicious delivery page hosted through archivogratuito[.]online.
Victims are ultimately prompted to open an HTA file, such as Doc_02º.HTA. When launched, the file is handled by mshta.exe, a signed Microsoft binary designed to execute HTML Applications.
Because mshta.exe is installed on many Windows systems, attackers frequently abuse it as a living-off-the-land binary to evade application controls and security monitoring.
The HTA launcher moves its application window outside normal screen boundaries using window.moveTo(6823, 3940), effectively hiding its activity from the victim. It then dynamically injects remote JavaScript from attacker-controlled infrastructure.
That script performs reconnaissance using Windows Management Instrumentation, PowerShell, and environment-variable checks. The malware collects information including the Windows version, BIOS details, username, and system characteristics.
This intelligence lets operators decide whether to deliver later-stage malware based on the compromised endpoint’s value or configuration.
The next phase relies on HTML smuggling. A JavaScript dropper reconstructs a Base64-encoded ZIP archive directly within the browser using window.atob() and Uint8Array functions.
It forces the archive download through an invisible link and programmatic click event, requiring little or no additional user interaction.
The page displays Spanish-language messages such as “Descarga Iniciada” and “Procesando descarga” to make the payload delivery appear legitimate. The downloaded archive contains a 7-Zip self-extracting executable disguised as a Firefox installer.
The SFX file extracts malware to a temporary location and launches it through Windows process-execution functions. Fortra said samples are regularly recompiled, producing changing hashes that weaken signature-based detection.
The campaign combines phishing, off-screen HTA execution, obfuscated URLs, HTML smuggling, random filenames, and polymorphic executables to bypass layered defenses.
Mitigation
Organizations should immediately block archivogratuito[.]online, relevant URL shorteners, and suspicious GoDaddy-hosted infrastructure. Security teams should also restrict mshta.exe through AppLocker, Windows Defender Application Control, or Attack Surface Reduction rules.
EDR teams should hunt for mshta.exe launched from Downloads, Desktop, or AppData directories, especially where off-screen window behavior is followed by script injection, WMI discovery, PowerShell execution, 7-Zip SFX activity, and outbound network connections.
Email teams should investigate any SCL:-1 handling associated with libero.it or italiaonline.it senders and strengthen controls for Spanish-language invoice and legal-notice phishing lures.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
 files delivered through Spanish-language phishing emails.){kind=link}