Suspicious MSHTA Fake Auth URL

Duo Tech@duotech

•updated Jun 2, 2026•2•0•11

Detects the execution of mshta.exe containing a URL with an '@' character to spoof a legitimate domain (e.g., www.bbc.com@malicious.com), a technique used by Gamaredon in the GammaPhish stage to obfuscate the real C2 domain.