Malicious HTA's not just for Spammers

This report explains how attackers use malicious HTML Application (HTA) files—launched by mshta.exe—to execute PowerShell payloads in-memory, describes example scripts and tooling (Unicorn, Metasploit/msfvenom, Out-HTA), and offers operational tips for increasing success (naming, hosting over HTTPS, browser redirects). It is an instructional overview of HTA-based droppers and web-delivery techniques rather than a specific incident or observed campaign.