A nice way to prevent this attack chain is to alter the default application associated with these files (HTA, JS, VBA, VBS) to notepad.exe. Now when a user is successfully tricked into clicking a HTA ...