Hackers Abuse MSHTA Legacy Windows Tool to Deliver LummaStealer and Amatera Malware

Cybersecuritynews •Tushar Subhra Dutta • May 20, 2026

Hackers are exploiting a decades-old Windows tool to deliver dangerous malware onto unsuspecting systems, with consequences ranging from stolen passwords to full system compromise. The tool is MSHTA, short for Microsoft HTML Application Host, a built-in Windows utility that can run scripts from local files and remote internet locations. Attackers have been using it to […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

MSHTA Utility Exploited in Ongoing Malware Campaigns Bitdefender researchers have identified that the Microsoft HTML Application Host (MSHTA) utility is being actively exploited by cybercriminals to deliver a variety of malware, including infostealers and loaders. Despite the retirement of Internet Explorer in 2022, MSHTA remains a default component in Windows, allowing attackers to execute scripts from local or remote files. Recent campaigns have leveraged MSHTA for distributing malware like LummaStealer and Amatera through phishing tactics, fake software downloads, and social engineering. The use of MSHTA as a Living-off-the-Land binary facilitates stealthy malware delivery, making detection challenging. Attackers have also adopted new domain patterns for their infrastructure, indicating an evolution in their tactics. The persistence of MSHTA in Windows systems highlights the risks associated with legacy tools that continue to be part of the ecosystem. Microsoft plans to fully deprecate VBScript by 2027, but MSHTA's future remains uncertain as it is still widely used in malicious activities. 8 sources 68

Extracted Entities

Hackers Abuse MSHTA Legacy Windows Tool to Deliver LummaStealer and Amatera Malware

The full story

Extracted Entities

Attack Types (1)

Malware (2)

MITRE ATT&CK (2)

Platforms (1)

Tools (1)