Phishing campaigns increasingly do more than immediately capture credentials or deliver a final payload. In a recent phishing campaign, a malicious HTML Application (HTA) was documented first collecting information about a victim’s device, before enabling later-stage payload delivery. This reconnaissance-first approach gave operators time and context to decide whether the device was worth further investment and what malware was most likely to succeed.
This important shift in attacks is operational: reconnaissance is embedded in the delivery chain. Rather than treating the initial execution as the end goal, the campaign uses it to collect intelligence before committing to subsequent stages. Put simply, threat actors are now checking your device first, then choosing the best malware to attack it with.
Why Old Attack Techniques Still Work
HTA malware is not new, but its execution path remains useful. HTA files can invoke scripts through mshta.exe, a Windows binary that remains available on many systems. Because mshta.exe is legitimate and historically used to run HTML Applications, its presence alone does not necessarily look suspicious.
HTA files provide broad access to the system and can be effective at evading endpoint and browser controls. In this campaign, the HTA is launched through mshta.exe and moved outside normal screen bounds, reducing the chance that the victim notices its activity. The lesson is not that every older technique is inherently dangerous, it is that familiar Windows components can still be abused effectively when they blend into expected activity.
For organizations, this means that seemingly minor signs of system discovery should not be dismissed simply because no destructive payload has appeared. The reconnaissance stage may be the point at which attackers are deciding whether to escalate their efforts.
The Rise of Reconnaissance First Attacks
This particular campaign performs system profiling with WMI queries, PowerShell, and environment-variable inspection. Reported collection includes the operating system version, BIOS information, username, and environmental details. This information can help an attacker identify sandboxes or low-value machines, distinguish likely enterprise targets, and select a follow-on payload that matches the environment.
A reconnaissance-first workflow also gives the operator flexibility. The same initial lure can support different outcomes: an infostealer, another malware loader, or a payload chosen for a specific target. That makes early discovery behavior especially important to defenders, even when the final payload has not yet been identified.
Modern Evasion Is About Layering Techniques
Each layer creates a different detection challenge. Email defenses may see only the lure, endpoint controls may see a signed Windows binary, and signature-based tools may see constantly changing file names or hashes. Correlating those signals is more effective than evaluating each one in isolation, and reinforces that attackers do not need a single breakthrough technique to succeed. Increasingly, they are combining multiple familiar techniques, each designed to bypass a different layer of defense.
Conclusion
This campaign illustrates how attackers can combine established techniques into an adaptable delivery framework. Detecting reconnaissance activity and the relationships among execution, smuggling, and follow-on processes can reveal the campaign before the attacker reaches the final payload.
To protect against these attacks, defenders should avoid focusing exclusively on malware names or indicators. These can and will create blind spots. The more durable detection strategy is behavioral: investigate mshta.exe launched from user-writable locations, HTML content containing large Base64 blobs, unusual script-driven downloads, off-screen HTA behavior, and process chains that combine WMI or PowerShell discovery with new executable launches.
For security leaders, the lesson is that visibility into reconnaissance activity is becoming just as important as detecting malware itself. As attackers increasingly customize attacks based on information gathered from victim environments, organizations that can identify and disrupt discovery behavior early may be able to stop intrusions before they escalate into credential theft, data theft, or ransomware incidents.
_______
About Aranzazu CasillasÂ
Aranzazu Casillas is a Cybersecurity Researcher with Fortra’s Intelligence and Research Experts (FIRE) team. She specializes in phishing investigations, malware analysis, threat research, and identifying online threats, including malicious websites and scam campaigns.
Join our LinkedIn group Information Security Community!
