Hackers Abuse MSHTA Legacy Windows Tool to Deliver LummaStealer and Amatera Malware

The report from Bitdefender/CSN describes multiple active campaigns abusing the legacy Windows MSHTA utility to fetch and execute remote scripts that lead to credential- and wallet-stealing malware (LummaStealer, Amatera) and other loaders (CountLoader, Emmenhtal, ClipBanker, PurpleFox); campaigns use phishing, fake installers, clipboard-based social engineering (ClickFix), fileless in-memory execution, and a large set of domains/IPs/hashes as IoCs while recommending blocking or restricting mshta.exe, user education, and layered defenses.