WhoisXML API uncovered 62,081 domains referencing the 2026 U.S. midterm elections, including look-alike candidate stores traced to a few registrants. Download the threat research materials now.
Continue readingUnder the DNS Hood of an Ongoing Legacy MSHTA Tool Attack
Bitdefender recently detailed1 how attackers continue to abuse Microsoft's legacy MSHTA utility to deliver malware across several campaigns. In one of the most prominent clusters, threat actors used the HTA-based loader CountLoader to deploy the LummaStealer and Amatera infostealers, which are built to harvest credentials, browser-stored data, session tokens, and cryptocurrency-related information from infected systems.
Bitdefender's research publicized 128 network IoCs across subdomains, domains, and IP addresses. Aided by the WhoisXML API MCP Server2, we narrowed these to 120 IoCs for our investigation, after filtering out inactive or legitimately owned domains.
Using our homegrown tools to investigate the threat, we uncovered these findings:
- 17 unique client IP addresses that communicated with 28 of the domain IoCs
- Four domain IoCs that appeared in three typosquatting groups with 3–9 members each
- 20 domain IoCs that were likely registered with malicious intent
- 618 unique IP addresses potentially owned by victims that communicated with 25 of the IP IoCs
- 2,260 email-connected domains, 56 of which were confirmed malicious
- 42 additional IP addresses, all of which were confirmed malicious
- 96 IP-connected domains, 17 of which were confirmed malicious
- 1,571 string-connected domains, five of which were confirmed malicious
Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.
—
- [1] https://www.bitdefender.com/en-us/blog/labs/microsofts-mshta-legacy-malware-windows
- [2] https://main.whoisxmlapi.com/ai/mcp-server