This Webpage Just Hacked You (FileFix HTA Attack)

[SRZ]

One-Line Map:
Save a webpage ➜ Rename to .hta ➜ Double-click it ➜ You just ran malware (no warning)

---

So, What’s the Scam?

Someone sends you a website and says,
“Hey, save this page and rename it to something nicer… like ‘ImportantFile.hta’ ”

You click.
You smile.
Your computer starts running secret commands behind your back.
No warning, no pop-up, no “Are you sure?”

---

How It Slips Past Windows Like a Ninja

• You save a webpage like normal (Ctrl + S)
• Browser saves it safely, BUT skips tagging it as “from internet”
• You rename it from .htm to .hta
• You double-click it
• Windows says: “Sure, come right in!”
• A hidden script runs PowerShell silently in the background
• Congratulations. Your PC is now a stage for someone else’s circus

---

What the File Actually Does (No Jargon)

Inside the file, there’s a hidden command saying:

“Hey Windows, quietly open PowerShell and pull this shady code from the internet.”
And Windows, the ever-helpful assistant, says:
“You got it, boss.”

---

Red Team Side – How Bad Guys Use This

• They tell users to “save the page as a fix” or “MFA backup”
• Or name it “Invoice” or “Refund Details” or some other corporate mumbo jumbo
• File looks innocent… but the moment you rename and run it—BOOM
• PowerShell starts doing yoga in the background, downloading more bad stuff

---

Blue Team Side – How to Shut It Down

Step 1: Kill mshta.exe

• That’s the old-school tool used to run .hta files
• Block it with AppLocker or just remove its permissions
• It’s like taking away grandpa’s car keys before he crashes into a firewall

Step 2: Make Windows show real file names

• Enable “Show file extensions” in File Explorer
• Now you’ll see if a file ends in .hta, not just “Important Document”

Step 3: Hunt for weird file activity

• Watch your logs for anyone saving and opening .hta files
• If you see it, ask: “Why is Jerry from accounting trying to run legacy web apps?”

Step 4: Train your team like you train pets

• Teach them: “Don’t rename file types. Ever.”
• If it walks like HTML, talks like HTML… don’t turn it into a hacker gateway.

---

For Regular Folks – 5 Things That Actually Work

1. Show full file names
   → In Windows File Explorer, turn on “File name extensions”

2. Don’t rename web pages to .hta
   → If someone tells you to—block them or delete the email

3. Let Windows update itself
   → It patches security holes while you sleep

4. Block mshta.exe (or ask your IT friend to)
   → So .hta files don’t even launch

5. Use common sense
   → If the file has an odd name, ends in .hta, and looks too helpful—it’s probably evil

---

Reality Slap

• Still built-in: mshta.exe is on every Windows machine
• Still dumb: Browsers don’t warn you when saving web pages
• Still sneaky: Antivirus might miss the first step entirely
• Still real: This trick is already out there—and getting copied fast

---

Helpful Stuff

• Full Writeup – FileFix HTA Exploit Details
• Disable mshta.exe (Microsoft Docs)
• Original Research and Demo

---

Final Thought (centered)

Renaming a file should not be a crime.
But Windows treats it like an open bar at a hacker party.

Don’t trust .hta.
Don’t rename files.
Don’t be the reason IT drinks before noon.