'This reveals a broader security problem': Experts warn a key Microsoft legacy tool is still being abused to launch malware campaigns

World Password Day 2025.

• Bitdefender reports rising abuse of the legacy MSHTA utility to deliver infostealers and loader malware
• Campaigns range from simple commodity threats like LummaStealer to advanced persistence tools such as PurpleFox
• Defenders are urged to restrict outdated scripting utilities and deploy layered security controls to detect malicious script activity

Cybercriminals are increasingly using a legitimate legacy Windows tool to deploy infostealers and loader malware, researchers are saying.