HTML Smuggling on Rise

Microsoft warn that threat actors are increasingly using HTML smuggling technique in phishing campaigns to stealthily deliver threats.

HTML smuggling is a highly evasive technique for malware delivery that leverages legitimate HTML5 and JavaScript features. The malicious payloads are delivered via encoded strings in an HTML attachment or webpage. The malicious HTML code is generated within the browser on the target device which is already inside the security perimeter of the victim’s network.

HTML smuggling lets an attacker “smuggle” an encoded malicious script within a specially crafted HTML attachment or web page. When a target user opens the HTML in their web browser, the browser decodes the malicious script, which, in turn, assembles the payload on the host device.Thus, instead of having a malicious executable pass directly through a network, the attacker builds the malware locally behind a firewall.