Microsoft Office HTML Injection bug can expose secrets

Published August 10, 2026

Attackers are tricking people into installing real remote-support software, then using it to take control of their computers. The campaign has used fake tax forms, invoices, and shipping notices as bait across 46 countries since January 2026.

Report priority
High
Targets
GoTo Resolve+4 more

How it works

  • A phishing email links to a short-lived page that mimics a document portal and offers a password-protected ZIP file, which is harder for mail scanners to inspect.
  • Opening it and running the script inside launches PowerShell, which downloads and installs a real remote-access tool the attacker can then use.

What to do

Check whether any GoTo Resolve, LogMeIn Rescue, ScreenConnect, ConnectWise, or ITarian installation on your network was not requested by IT or does not match your approved remote-access tool list, especially one that followed a password-protected ZIP download or a script run from an unusual location.

Keep an approved inventory of remote-access software, treat any installation outside that list as an alert, and train staff to be suspicious of access-code pages and password-protected ZIP attachments in unexpected tax, invoice, or shipping emails.

Technical details

Affected software: GoTo Resolve, LogMeIn Rescue, ScreenConnect, ConnectWise, ITarian

An email claims to carry a Canada Revenue Agency tax form and links to a page hosted on a trusted cloud platform. The page gives an access code and offers a password-protected ZIP archive, and the victim extracts it and runs the Visual Basic script inside. That script tells PowerShell to download and install a real remote-support tool like GoTo Resolve or LogMeIn Rescue, handing the attacker hands-on access to browse the system and run commands.

The delivery chain uses disposable pages on platforms like Vercel (94% of 240 observed hosts lasted only one day, including 82 one-time Vercel apps) plus anti-analysis checks: browser and location fingerprinting, occasional hCaptcha challenges, Telegram-based visitor filtering, and a delay before the payload downloads. A password-protected ZIP contains a VBS script that invokes PowerShell to fetch and silently install a legitimate RMM client, giving the operator hands-on-keyboard access without dropping custom malware that antivirus tools would flag. ANY.RUN tracked 425 kit URLs across 240 hosts from February 5 to July 29, 2026, active since January 2026.

References

View Original Source