Suspicious MSHTA Execution with MSIXBUNDLE Extension

Ethan Andrews@eandrews

•updated May 6, 2026•40•1•1,253

Detects the execution of mshta.exe attempting to download and execute a remote payload masquerading as an msixbundle file. This technique is used in the InstallFix campaign to deliver ZIP/HTA polyglots.