Executive Summary
Beginning in June and still active at the time of publication, Fortra Intelligence and Research Experts (FIRE) have been tracking a targeted phishing campaign distributing an HTA (HTML Application) malware payload, a file whose purpose is to harvest reconnaissance information about the infected machine and its BIOS via SCRIPT executed through mshta.exe, and to pull later stages based on the initial recon results, until a packed executable is dropped to disk.
The multi-stage architecture of these attacks allows the attacker to selectively deploy payloads based on system characteristics, increasing success rates by deploying payloads tailored to the infected machine. Spanish-speaking organizations and users face elevated targeting risk. Successful compromise can mean full system reconnaissance and potential deployment of additional malware payloads.
Introduction
FIRE has identified and is tracking phishing campaign whose objective is to steal local secrets via an infostealer, although the multi-stage payload execution could easily allow for a different targeted payload. The additional targeting, reconnaissance and evasions techniques make this campaign significant.
While HTA malware is generally considered an older attack technique, mshta.exe is still present on most Windows systems and is effectively abused for running living off the land binaries (LOLBINs). HTA files also have broader access to the system, making it ideal for conducting initial reconnaissance and appears to effectively evade many endpoint and browser based controls.
The campaign is primarily targeting Spanish-language users at global companies and demonstrates consistent use of Spanish language artifacts throughout the payload and social engineering lures. Notably, the delivery infrastructure also includes Portuguese language elements (particularly in intermediate pages), suggesting potential cross-campaign reuse or broader Hispanic/Lusophone targeting.
Phishing emails originate primarily from the Italian domain libero.it, with SCL:-1 bypass enabling direct inbox delivery despite anti-spam categorization. Lures include convincing Spanish-language social engineering pretexts: fake invoices (Facturación) and fake judicial notices (Aviso Judicial), designed to coerce victims into clicking malicious links.
Once installed, the malware performs reconnaissance using WMI queries, PowerShell, and environment variable inspection. The second stage involves an HTML-smuggling JavaScript dropper that reconstructs a Base64-embedded ZIP archive and forces its download without user interaction. The final payload is a 7-Zip self-extracting archive (SFX) disguised as a Firefox installer, which extracts and executes the real malware.
Samples are recompiled with different hashes to evade signature-based detection, indicating an active and maintained campaign.
This campaign stands out because it employs multiple evasion techniques including off-screen HTA windows, HTML smuggling, random file names, and polymorphic executables. Combined with email filter bypass (SCL:-1) and sophisticated social engineering in Spanish, these techniques bypass traditional email filtering and endpoint detection solutions. The use of legitimate Italian email providers (libero.it) provides operational cover and plausible deniability.
Top actions:
Block the infrastructure IOCs at proxy/firewall/DNS layer (archivogratuito.online and URL shorteners).
Restrict mshta.exe via AppLocker/WDAC or ASR rules.
Hunt for off-screen HTA execution patterns in EDR logs.
Alert on NSIS installer execution followed by script injection and network connections.
Monitor phishing emails with Spanish-language content originating from italiaonline.it infrastructure.
This FIRE intelligence was produced following the identification of multiple malicious email samples received across different lure themes within the same week. All samples demonstrated consistent Spanish-language social engineering content, originating from Italian email infrastructure (libero.it via italiaonline.it), suggesting deliberate targeting of Spanish-speaking users.
The samples demonstrated consistent infrastructure patterns, delivery mechanisms, and social-engineering techniques, all conducted in Spanish with minor Portuguese language spillover in intermediate pages.
Analysis was conducted through static and dynamic binary analysis, email forensics (header analysis via emlcheck), and infrastructure mapping without execution in a sandbox environment.
The report is produced now because the campaign is actively distributing new samples with updated hashes, the infrastructure remains operational, and the techniques employed represent a significant threat to Spanish-language users across multiple sectors.
Email Forensic Analysis
Four distinct phishing email samples were collected, all using the same strategy but with different social engineering lures and minor variations in delivery infrastructure. All samples originate from Spanish-speaking threat actors, as evidenced by consistent use of Spanish language throughout email content, social engineering pretexts, and payload source code comments.
Threat Landscape
Multi-stage phishing campaigns delivering malware via social engineering remain one of the most prevalent initial access methods observed across sectors. The distinguishing characteristics of this campaign are:
Spanish-language targeting: Consistent use of Spanish language throughout delivery, social engineering, and payload construction indicates deliberate focus on Spanish-speaking users and organizations.
Cross-infrastructure deployment: Use of Italian email providers (libero.it), Russian URL shortener infrastructure (goo.su via DDoS-Guard), and US-hosted delivery servers suggests a distributed actor with resources to operate across geographic boundaries.
HTML smuggling and off-screen execution: Advanced evasion techniques combining off-screen HTA windows, polymorphic executables, and random file names to evade both email filtering and endpoint detection.
The social engineering lures observed in this campaign are diverse and contextually plausible (Spanish invoices, Spanish judicial notices), suggesting the actor tailors delivery to specific targets rather than conducting broad spray campaigns. The weekly recompilation of samples to maintain different hashes is consistent with a threat actor actively monitoring detection rates on platforms such as VirusTotal.
The requirement to obtain and maintain libero.it email accounts (requires phone number verification) and orchestrate multi-stage delivery infrastructure represents meaningful operational overhead, pointing toward a financially motivated and resourced threat actor.
Impact Assessment
Operational Impact
Successful infection results in immediate system reconnaissance via WMI and PowerShell. The attacker gains detailed information about the victim's system (OS version, BIOS details, user name, installed software via environment variables). This reconnaissance enables the attacker to make informed decisions about deploying additional payloads tailored to the system's characteristics.
Financial Exposure
Potential exposure depends on what additional payloads are deployed post-reconnaissance. The multi-stage architecture suggests the attacker selectively deploys ransomware, info-stealers, or other payloads based on target profitability. Spanish-speaking organizations and users are specifically targeted, with particular focus on financial and government sectors (as evidenced by invoice and judicial notice lures).
Detection Difficulty
The combination of off-screen HTA execution, HTML smuggling, and random file names makes detection difficult for standard antivirus and email filtering solutions. The SCL:-1 bypass on incoming emails (circumventing anti-spam filtering) further reduces detection likelihood. Email filters may not flag Spanish-language content as suspicious if they lack Spanish language processing or cultural awareness of these specific lures. Without specific IOA-based blocking or behavioral pattern detection (off-screen HTA + script injection + network connection), this activity is likely to evade standard monitoring.
Reputational Risk
If a compromised endpoint has access to customer data, proprietary information, or internal communications, the reputational and regulatory exposure from a breach could be significant. Spanish-speaking organizations in regulated sectors (financial services, healthcare, government) face elevated regulatory risk from data protection laws such as RGPD, LOPD (Spain), or LGPD (Brazil).
Mitigation Guidance
Immediate (within 24 hours):
1. Block or alert on outbound DNS and HTTPS traffic to archivogratuito[.]online on perimeter controls and endpoint DNS filtering.
2. Block or alert on traffic to the three URL shorteners (goo[.]su, abrir[.]link, abre[.]ai) if not operationally required.
3. Block outbound connections to 192.169.176[.]182.host.secureserver.net and 231.72.148[.]132.host.secureserver.net.
4. Alert on mshta.exe execution from user-writable directories (Desktop, Downloads, AppData).
5. Audit and remediate SCL:-1 bypass: review mail flow rules allowlisting libero.it, italiaonline.it (213.209.8.0/24, 213.209.10.0/24), or specific sender domains. Investigate why CAT:HPHISH emails receive SCL:-1 instead of being quarantined.
6. Monitor inbound emails from italiaonline.it/libero.it domain and IP ranges for Spanish-language content with typical phishing pretexts (Facturación, Aviso Judicial, legal language).
Short term (within one week):
7. Deploy detection rules in EDR and SIEM for off-screen HTA execution: window.moveTo() with large coordinate values (>5000) followed by script injection.
8. Implement email gateway rules to flag or quarantine messages with LANG:es header if not targeted at Spanish-speaking organizations, or apply additional scrutiny to Spanish-language emails with invoice/legal content from external senders.
9. Implement rules to detect HTML smuggling patterns: large Base64 blobs in HTML, atob() calls followed by Uint8Array construction. Consider language-specific pattern matching for Spanish source comments (e.g., "Descarga" in JavaScript).
10. Alert on NSIS installer execution followed by 7-Zip SFX extraction and PowerShell/WMI queries.
11. Submit confirmed sample hashes to threat intelligence platforms for broader community visibility, with annotations about Spanish-language targeting.
12. Conduct targeted awareness training for Spanish-speaking employees about these specific lures (invoices, judicial notices). Emphasize that legitimate invoices and legal notices are rarely distributed via email links, especially from unexpected sources.
Ongoing:
13. Restrict mshta.exe via AppLocker/WDAC or ASR rules ("Block execution of potentially obfuscated scripts").
14. Monitor for new sample hashes exhibiting the same behavioral profile as the actor recompiles weekly. Track polymorphic SFX executables with different SHA256 per sample.
15. Hunt retroactively in EDR logs for the off-screen HTA pattern (window.moveTo) and 7-Zip SFX execution disguised as Firefox.
16. Monitor 213.209.8.0/24 and 213.209.10.0/24 (italiaonline/libero.it infrastructure) for phishing emails targeting your organization, with particular attention to Spanish-language content.
17. Establish threat intelligence sharing with other organizations in Spanish-speaking regions to track this campaign and variants targeting similar demographics.
Closing Notes
The core risk in this campaign is not the technical sophistication of individual components — it is the orchestrated combination of evasion techniques (off-screen HTA, HTML smuggling, polymorphism) designed to defeat multiple layers of security controls simultaneously. Combined with targeted Spanish-language social engineering, SCL:-1 bypass, and careful infrastructure selection (Italian email, Russian shorteners, US delivery servers), this campaign represents a mature threat actor with geographic operational awareness and linguistic/cultural targeting capability.
The multi-stage payload delivery allows the attacker to conduct reconnaissance before committing to further attack stages, enabling selective targeting based on system characteristics and profitability.
The Spanish-language artifacts throughout the campaign (email headers, social engineering content, source code comments, UI strings) represent intentional targeting or specialization, not accidental spillover. The Portuguese-language contamination on the intermediate page suggests the same actor has conducted previous campaigns targeting Portuguese-speaking regions, indicating a broader geographic focus on Hispanic and Lusophone markets.
The most impactful immediate action is blocking the specific infrastructure IOCs (archivogratuito[.]online, URL shorteners, C2 hosts) and restricting mshta.exe execution. These two controls directly sever the attacker's delivery chain and prevent payload execution.
The actor is actively maintaining this campaign. New lures, recompiled samples, and updated hashes should be expected. The IOCs in this report should be treated as a current snapshot, not a complete picture. Spanish-speaking organizations should treat this as a targeted threat.
Immediate next steps and owners:
Network/Firewall team: Block archivogratuito[.]online, URL shorteners, and GoDaddy C2 hosts
Endpoint/EDR team: Hunt for off-screen HTA execution, 7-Zip SFX with Firefox branding, WMI queries
Threat Intel team: Submit hashes, monitor for new samples from italiaonline infrastructure, track Portuguese-language variants
Email Security team: Update gateway rules for Spanish-language phishing lures, investigate SCL:-1 bypass from libero.it infrastructure, implement LANG:es header alerting
User Education/Communications: Conduct targeted awareness for Spanish-speaking staff about invoice and judicial notice phishing lures, emphasize not clicking links in unexpected emails from authorities.
Appendix A — File Hashes and Samples
HTA Launcher:
Doc_02º.HTA
SHA256: 24282A88DE4F55B9D469D8F31424B0C68A860AC21DCB62EE69348A3FFF71DE19
JavaScript Dropper:
DetAdj_272.zip (secondary ZIP written to disk by JS dropper)
Dropped Executable (7-Zip SFX):
UUGJNKSEQB2AOXQKLKHNFUK5Z
SHA256: 81725DD3E5ADB872F3832401911291B3D1
Appendix B — Network Indicators
C2 Hosts:
192.169.176[.]182.host.secureserver.net (GoDaddy, Apache 2.4.52, Ubuntu)
231.72.148[.]132.host.secureserver.net (GoDaddy, suspicious)
Intermediate Pages:
Archivogratuito[.]online (Cloudflare) — Note: Title[Redirecionamento] in Portuguese suggests template reuse from Portuguese-language campaign
URL Shorteners:
goo[.]su (82.202.170[.]126, DDoS-Guard, Russia)
abrir[.]link (158.69.112[.]86, Apache 2.4.57, United States)
abre[.]ai (parameters mimicking AdobeSign)
Email Infrastructure:
libero.it (italiaonline.it, ASN AS13237, IPs: 213.209.8.0/24, 213.209.10.0/24) — Free email provider, account creation requires only phone number
Outlook/Office 365 abuse (52.103.11.73, US) — Demonstrates secondary abuse of cloud email infrastructure for geographic diversity and anti-filtering bypass
Appendix C — Static Analysis and Language Notes
Delivery Page Characteristics:
Source-code comments: Entirely in Spanish, confirming Spanish-speaker authorship or translation
Random HTML title generation: Defends against signature-based detection by generating different page titles per request (hF4wTNL4ksVV2d, fHCep, kSS7yGO8FuV)
Base64 ZIP encoding: Complete ZIP archive embedded as Base64 text variable in page source
HTA Launcher Characteristics:
Off-screen evasion: window.moveTo(6823, 3940) pushes window outside normal monitor bounds
URL construction: IIFE concatenates C2 URL to defeat simple grep searches
Remote script injection: Script tag dynamically injected into HTML head
JavaScript Dropper Characteristics:
HTML smuggling: Malware embedded as Base64 text variable in page source
Decoding: window.atob() + byte-by-byte Uint8Array reconstruction
Forced download: data-URI + invisible anchor tag + programmatic .click()
Social engineering theater: Spanish UI text ("Descarga Iniciada", "Tu descarga ha comenzado. Verifica la esquina inferior derecha de tu navegador", "Procesando descarga..."), progress bar animation, then redirect to about:blank after ~5 seconds
Source code comments: Spanish language source code comments in JavaScript, consistent with LANG:es header and delivery page comments
Reconnaissance: WMI queries for OS, BIOS, user name; PowerShell environment variable inspection
7-Zip SFX Characteristics:
Module: v18.05 (timestamp 30-Aug-2018)
Language: C++ with MSVC toolchain
Branding: Firefox installer disguise (strings: "Can not find setup.exe")
Stub role: Dropper/extractor only; imports KERNEL32/MSVCRT; no network capability
Extraction: Temp folder → payload → CreateProcessA/ShellExecuteExA
Anti-DLL hijacking: SetDefaultDllDirectories, SetDllDirectoryW, DLL list (UXTHEME, SETUPAPI, CRYPTBASE)
Polymorphism and Language Consistency:
The executable's SHA256 does not match 81725DD3E5ADB872F3832401911291B3D1 across all samples, indicating polymorphic packing with different embedded data per victim.
Spanish language consistency throughout all stages suggests deliberate targeting and authorship, not accidental. All source code comments, UI strings, and email content are intentionally in Spanish.
Portuguese contamination on intermediate page (Title[Redirecionamento]) indicates template reuse from prior Portuguese-language campaign, suggesting same actor or shared infrastructure across Hispanic/Lusophone campaigns.
