HTML Smuggling

HTML smuggling is a delivery technique that hides a malicious payload inside an apparently harmless HTML attachment or webpage. Instead of sending malware over the network as a recognizable file, the attacker sends JavaScript and an encoded blob of data; the victim's own browser decodes the blob and "builds" the malicious file locally, usually triggering an automatic download. To every security control watching the wire — email gateway, web proxy, sandbox detonating attachments — nothing malicious ever crossed the network. The payload only exists once it is assembled on the endpoint.

How it works

The attack rides standard, legitimate browser features: JavaScript Blob objects and the HTML5 download attribute, both essential to how modern web applications hand users files. A typical sequence starts with a phishing email carrying an HTML attachment disguised as an invoice, a voicemail notification, or a secure-document viewer. Opening it runs the embedded script, the payload is reconstructed in memory, and the browser drops an ISO, ZIP, or executable into the Downloads folder — often password-protected, with the password displayed on the decoy page, specifically to frustrate automated scanning of the next stage.

Microsoft has documented both state-sponsored espionage groups and banking-trojan and ransomware operators using the technique at scale, and commodity phishing kits now include it as a standard option. It persists because it is cheap, reliable, and abuses functionality that cannot simply be switched off without breaking the legitimate web. Many intrusions that end in ransomware begin exactly here — see how ransomware actually starts.

How to defend against it

• Treat HTML attachments as executable content. Very few business processes require emailing raw .html or .htm files; block or quarantine them at the gateway, or rewrite them to open in a sandboxed viewer.
• Teach the tell. An email attachment that opens a browser and spontaneously downloads a second file is an attack signature. Employees should stop at the unexpected download — especially one with a password supplied on the page.
• Control what follows the smuggle. Block auto-mounting of ISO/IMG files, require marked-of-the-web enforcement, and alert on browsers writing executables to disk.
• Verify, then open. Any "secure document" that insists on its own viewer instead of your organization's known channels deserves a report, not a click.