CountLoader USB .lnk launching mshta.exe with remote URL shortly after drop

Duo Tech@duotech

•updated Aug 4, 2026•4•0•7

Detects CountLoader's taskType 9 USB-worming behavior: a recently created/modified .lnk file on a non-system drive followed by mshta.exe execution referencing that .lnk with a remote HTTP(S) URL.