Legacy Windows Tool MSHTA Fuels Surge in Silent Malware Attacks

A decades-old Windows utility called MSHTA is driving a sharp rise in silent malware attacks, according to BitDefender researchers who detected dramatic increases in abuse since the start of this year. The Microsoft-signed tool, originally designed to run HTML applications, is being exploited by attackers as a "Living-off-the-Land binary" to deliver everything from cryptocurrency-stealing malware to advanced persistent threats like PurpleFox, typically through social engineering tactics that trick users into executing malicious commands. Security experts say the primary defense is user awareness training combined with blocking access to these legacy binaries unless they're absolutely necessary for business operations.