mshta lures fetching remote HTAs

Summary

Alongside the audio-file cases, Trend Micro's incident data held a run of counterfeit verification pages whose common trait was simply the instruction to paste a line into a system prompt. Each page assembled that line in the browser, decoded it from base64 and placed it on the clipboard, so the visitor never read the destination. Most aimed mshta at a remote HTML Application on a short-lived domain; one used a hidden PowerShell instruction that retrieved a text file and evaluated its contents. Victims arrived through malvertising, through email, and in one investigated case through a poisoned search result for a stately-home visitor attraction, where the top-ranked link was a legitimate website that had been broken into. Trend Micro does not tie these particular hosts to any named malware family.

Execution mechanisms

How the pasted command actually ran, as the published accounts describe it. Every row under “Mechanism” is one this campaign records; “Across the corpus” is the share of the 44 published campaigns in this corpus that record the same one — a baseline we can only state because we hold the whole set.

All 3 of these mechanisms appear together in 3 of the 44 campaigns on record, this one included. We record a mechanism only where a source describes one: an absent mechanism means nobody wrote it down, not that it did not happen.

Indicators

6 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator. No observation date is recorded for any of them.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.