Fareit Spam: Rocking Out to a New File Type
Summary: Cisco Talos documented a small spam campaign impersonating an HSBC billing payment document that used .mht (MIME HTML) files, an uncommon email attachment type, to deliver the Fareit credential-stealing trojan. The .mht file referenced an .hta file hosted on a compromised website, which ran a vbscript to pull a further file, ending in a Fareit payload with C2 domain jerryotis[.]pw.
What you should know: The campaign's own email included security tips warning against opening attachments from unknown senders, and a user who followed them would have avoided infection. Talos notes the small-scale .mht use could be a test run that grows in volume if attackers find it effective, and that the compromised site was cleaned up before analysis, leaving responders to reconstruct the chain from hashes and URLs alone.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026