Related Threat Clusters

MSHTA Utility Exploited in Ongoing Malware Campaigns
Bitdefender researchers have identified that the Microsoft HTML Application Host (MSHTA) utility is being actively exploited by cybercriminals to deliver a variety of malware, including infostealers and loaders. Despite…

8 articles · Updated May 19, 2026
Fake Proxifier Installer Distributes ClipBanker Crypto Malware via GitHub
Hackers are exploiting a counterfeit Proxifier installer available on GitHub to deploy ClipBanker malware, which targets cryptocurrency users. This multi-stage malware hijacks clipboard activity to swap cryptocurrency…

2 articles · Updated April 14, 2026

Recent Intelligence Reports

Attackers turn ancient Windows utility MSHTA into Swiss Army knife of hacking — Cybernews · May 19, 2026
Microsoft's MSHTA Legacy Tool Still Powers Malware Campaigns on Windows — Bitdefender · May 19, 2026
Internet Explorer may be dead, but its ghost still runs malware — Csoonline · May 19, 2026
Fake Proxifier GitHub Installer Spreads ClipBanker Crypto Malware — Gbhackers · April 14, 2026
Hackers Use Fake Proxifier Installer on GitHub to Spread ClipBanker Crypto — Cybersecuritynews · April 14, 2026

DDoS Malware Phishing Trojan CastleLoader Campaign ClipBanker Campaigns CountLoader Campaigns Emmenhtal Loader Campaigns LummaStealer Campaign PurpleFox Campaigns Amatera CastleLoader