Microsoft MSHTA: Legacy Tool Fuels Ongoing Malware Campaigns

Bitdefender Labs is reporting that attackers are still leveraging Microsoft HTML Application Host (MSHTA), a built-in Windows utility. MSHTA’s ability to execute VBScript and JavaScript from remote sources makes it a persistent tool for malware delivery. This legacy component, present on most Windows systems, bypasses traditional defenses by appearing as a legitimate system process.

Attackers are exploiting MSHTA to download and execute malicious payloads, often as part of broader phishing or social engineering campaigns. The ease of use and ubiquity of MSHTA mean defenders cannot rely on its absence; instead, they must assume its potential misuse. This highlights a critical gap where legacy features, though seemingly benign, remain potent attack vectors.