Hidden between the tags: Insights into spammers’ evasion techniques in HTML Smuggling
Summary: Cisco Talos reports that HTML smuggling campaigns embed encoded or encrypted JavaScript in HTML attachments and web pages, which browsers decode and run automatically to deliver malware or redirect victims to phishing pages. Talos documents evasion techniques including trailing-dot extensions like "html." that shift Content-Type from text/html to application/octet-stream, chained and repeated encoding, identifier renaming, and a December 2023 sample combining base64, a Caesar-style cipher, and obfuscation.
Bottom line: Talos observed a peak in emails using this technique on Feb. 2, 2024, with American customers targeted significantly more than European ones and human resources, insurance, and healthcare hit hardest - so a filter that only decodes once will miss the double-encoded and AES-encrypted attachments already reaching inboxes.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026