MSHTA Abuse Resurfaces as Threat Actors Push LummaStealer and Amatera Payloads

This report describes active campaigns abusing the Windows mshta.exe binary as a LOLBIN to deliver information-stealers (LummaStealer, Amatera) via HTA/Python-based loaders and ClickFix social engineering, employing fileless PowerShell execution and AMSI bypass; it includes actionable IOCs (SHA256 hashes and URLs) and mitigation guidance (restrict mshta.exe/wscript.exe, user training, layered defenses).