Military pay calculator HTA lure renames styles.dat to styles.dat.exe

Ethan Andrews@eandrews

•updated Jul 6, 2026•1•0•3

Detects a malicious HTA lure disguised as a military pay calculator. The attack involves a JScript routine that renames an embedded data file ('styles.dat') to an executable ('styles.dat.exe') and triggers its execution, characteristic of a spearphishing attachment delivering malware.