Hackers Exploit MSHTA to Deploy LummaStealer and Amatera Malware

Gbhackers •Mayura Kathir • May 20, 2026

Hackers are increasingly abusing the legacy Microsoft HTML Application Host (MSHTA) utility to deliver commodity malware such as LummaStealer and Amatera. Despite being tied to Internet Explorer, which was retired in 2022, MSHTA remains default in Windows, making it an attractive Living-off-the-Land binary (LOLBIN) for stealthy attacks. MSHTA allows execution of VBScript and JavaScript from […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

MSHTA Utility Exploited in Ongoing Malware Campaigns Bitdefender researchers have identified that the Microsoft HTML Application Host (MSHTA) utility is being actively exploited by cybercriminals to deliver a variety of malware, including infostealers and loaders. Despite the retirement of Internet Explorer in 2022, MSHTA remains a default component in Windows, allowing attackers to execute scripts from local or remote files. Recent campaigns have leveraged MSHTA for distributing malware like LummaStealer and Amatera through phishing tactics, fake software downloads, and social engineering. The use of MSHTA as a Living-off-the-Land binary facilitates stealthy malware delivery, making detection challenging. Attackers have also adopted new domain patterns for their infrastructure, indicating an evolution in their tactics. The persistence of MSHTA in Windows systems highlights the risks associated with legacy tools that continue to be part of the ecosystem. Microsoft plans to fully deprecate VBScript by 2027, but MSHTA's future remains uncertain as it is still widely used in malicious activities. 8 sources 68

Extracted Entities

Hackers Exploit MSHTA to Deploy LummaStealer and Amatera Malware

The full story

Extracted Entities

Attack Types (1)

Malware (2)

MITRE ATT&CK (3)

Platforms (1)

Tools (1)