Full Report
ClickFix techniques are enabling threat actors to bypass defenses using tools like MSHTA, says ReliaQuest
Analysis Summary
# Tool/Technique: MHSTA Abuse (Associated with ClickFix/ClearFake)
## Overview
MHSTA (Microsoft HTML Application Host) is being abused by threat actors, often facilitated by the **ClickFix** social engineering technique, to deploy infostealers, Remote Access Trojans (RATs), and support ransomware operations. MHSTA is a native Windows binary, allowing actors to bypass traditional security controls designed to detect file-based malware delivery.
## Technical Details
- Type: Technique/Binary Abuse
- Platform: Windows
- Capabilities: Execution of HTML application files (.hta), enabling defense evasion by using a legitimate, signed system binary.
- First Seen: The abuse linked to ClearFake was prominent in the previous reporting period; its use has significantly increased recently.
## MITRE ATT&CK Mapping
The primary focus is on Defense Evasion and Execution:
- **TA0005 - Defense Evasion**
- T1218 - Signed Binary Proxy Execution
- T1218.011 - MSHTA
- **TA0002 - Execution**
- T1204 - User Execution
*(Note: The context specifically mentions MSHTA abuse contributing to defense evasion tactics, aligning directly with T1218.)*
## Functionality
### Core Capabilities
- Executing malicious code embedded within HTML Applications (.hta) files.
- Bypassing security controls that focus on detecting traditionally malicious file types due to the legitimate nature of the `mshta.exe` binary.
### Advanced Features
- Used in conjunction with **ClickFix** social engineering to trick users into initiating the malicious execution chain.
- Previously leveraged by the **ClearFake** JavaScript framework to deceive users (often via fake CAPTCHAs) into executing MSHTA commands.
## Indicators of Compromise
*(The provided text does not contain specific IOCs like hashes or C2 locations, focusing instead on the method.)*
- File Hashes: [Not specified in the context]
- File Names: .hta files utilized in the execution chain.
- Registry Keys: [Not specified in the context]
- Network Indicators: [Not specified in the context]
- Behavioral Indicators: Execution originating from `mshta.exe`, often following user interaction prompted by social engineering lures (ClickFix).
## Associated Threat Actors
- Threat actors deploying infostealers and RATs.
- Associated with the **ClearFake** framework's adoption of these techniques.
## Detection Methods
- Signature-based detection: Limited effectiveness against legitimate binary abuse unless specific payloads or launch parameters are known.
- Behavioral detection: Monitoring for anomalous invocation of `mshta.exe`, especially execution paths not typically associated with standard user workflows or system operations.
- YARA rules: [Not specified in the context]
## Mitigation Strategies
- Prevention measures: Enhancing application control policies to restrict execution of potentially suspect binaries like MSHTA or strictly whitelist known good usage.
- Hardening recommendations: User awareness training focused on identifying and refusing requests generated by **ClickFix** social engineering schemes (e.g., prompts claiming system instability requiring immediate user action).
## Related Tools/Techniques
- ClickFix (The social engineering methodology enabling execution)
- ClearFake (A JavaScript framework previously known for pioneering this exploitation method)
- Infostealers and RATs (The payloads typically delivered via this method)