Suspicious MSHTA Fake Auth URL

Duo Tech@duotech

•updated Jun 5, 2026•2•0•13

Detects mshta.exe executing a remote URL that contains an '@' symbol, a technique used by Gamaredon (GammaPhish) to fake authentication and bypass naive URL filtering.