Security researchers have observed a sophisticated phishing operation specifically targeting Spanish-speaking employees by masquerading as official judicial notices or billing invoices. This specific campaign highlights a persistent trend where threat actors utilize localized social engineering to gain a foothold within global corporate networks. By presenting files as urgent legal documents or unpaid invoices—often labeled with terms like “Facturación” or “Aviso Judicial”—attackers exploit the natural professional pressure to address financial or legal matters immediately. This psychological manipulation is paired with a highly technical delivery chain designed to evade standard perimeter defenses. The campaign focuses on high-value targets across various industries, ensuring that the messages appear as legitimate as possible to the unsuspecting recipient. These efforts represent a calculated attempt to bypass automated security systems while simultaneously deceiving human users through the clever use of familiar language and official branding found in corporate communications across the Spanish-speaking world.
Mechanism: From Email to Execution
The technical execution of this campaign often begins with emails originating from Italian service providers, such as libero.it, which provides the attackers with a relatively stable infrastructure for sending large volumes of malicious messages. A standout feature of this operation is the sophisticated manipulation of the Spam Confidence Level (SCL). By successfully tricking the mail delivery environment into assigning an SCL value of -1, the attackers ensure that their messages bypass standard junk mail filters and arrive directly in the user’s primary inbox. This bypass is critical because it removes the initial layer of skepticism a user might feel if a message were flagged as potential spam. Once the email is delivered, victims are prompted to click on shortened URLs, which utilize various services to mask the destination and complicate automated link analysis. These redirects often cycle through multiple domains before landing on a final delivery site, such as archivogratuito.online, where the user is enticed to download the malicious HTA file.
The primary weapon in this campaign is the abuse of mshta.exe, a legitimate, Microsoft-signed binary intended for running HTML applications. This technique falls under the category of “living-off-the-land” attacks, as it uses pre-installed system tools to perform malicious actions, thereby evading many application control policies. To ensure the user remains oblivious to the infection, the HTA launcher incorporates a specific script command—window.moveTo(6823, 3940)—which immediately relocates the application window to coordinates far outside the visible area of the monitor. This clever maneuver allows the malware to run its scripts in the background without any visual cues that might alert a vigilant employee. While the process remains hidden from view, it establishes a foothold and begins communicating with the attacker’s command-and-control server. By utilizing a signed Windows utility, the malware often goes unmonitored by basic endpoint protection tools that prioritize scanning unsigned third-party software, providing the attackers with a stealthy environment.
Impact: Reconnaissance and Mitigation
After securing its presence on the machine, the hidden application initiated a comprehensive reconnaissance phase designed to determine the value of the compromised endpoint. Using a combination of Windows Management Instrumentation (WMI) and PowerShell scripts, the malware silently harvested sensitive system information, including detailed BIOS specifications, specific Windows versions, and the usernames of active accounts. This was followed by a technique known as HTML smuggling, which used JavaScript within the HTA environment to programmatically reconstruct a Base64-encoded ZIP archive directly within the memory of the victim’s web browser. By triggering a download event on an invisible link, the malware saved a 7-Zip self-extracting executable to the disk, which was cleverly disguised as a Firefox browser installer. This multi-stage process ensured that the final payload was only assembled once it had successfully bypassed initial network filters. The attackers frequently recompiled these malicious files to ensure that their digital signatures and hashes remained undetected by standard antivirus solutions.
Mitigating such a technical and adaptive threat required a multifaceted approach that combined infrastructure blocking with behavioral monitoring. Security experts recommended that organizations proactively block traffic to known malicious delivery domains like archivogratuito.online while simultaneously monitoring for suspicious connections originating from Italian hosting providers. Implementing robust application control through tools like AppLocker or Windows Defender Application Control became essential for restricting the unauthorized execution of the mshta.exe utility, which effectively broke the attack chain before the reconnaissance phase could begin. Furthermore, endpoint detection and response teams focused their efforts on hunting for instances of system utilities behaving abnormally, such as processes moving windows off-screen or initiating unusual PowerShell commands. These proactive measures provided a much-needed layer of defense against living-off-the-land techniques. By addressing the specific vulnerabilities exploited by this campaign, organizations successfully strengthened their overall posture and reduced the risks posed by sophisticated phishing operations.
