Operation XENOFISCAL - Mshta Command Line Obfuscation

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•4

Detects mshta executing the malicious URL/HTA but wrapped with caret (^) obfuscation typical of SideCopy.