Quarantined ZIP HTML stager launches via rundll32 SHCreateLocal to Edge

Ibrahim Saud@tektrix

•updated Sep 23, 2026•1•0•3

Detects a multi-stage local execution chain associated with the Mirage2FA malware. The activity begins with WinRAR extracting an HTML stager from an Outlook quarantine directory, followed by rundll32.exe invoking shell32.dll to open the stager, and concluding with a spawned Microsoft Edge process executing the local HTML file.