{"id":3372,"date":"2021-11-15T15:40:58","date_gmt":"2021-11-15T15:40:58","guid":{"rendered":"https:\/\/fortgale.com\/news\/?p=3372"},"modified":"2026-06-08T23:01:16","modified_gmt":"2026-06-08T23:01:16","slug":"html-smuggling-attack-technique","status":"publish","type":"post","link":"https:\/\/fortgale.com\/blog\/emerging-threats\/html-smuggling-attack-technique\/","title":{"rendered":"HTML Smuggling attack: an increasingly common technique"},"content":{"rendered":"\n

In recent months, multiple phishing email campaigns have been identified containing malicious HTML<\/strong><\/em> files (report<\/a>). <\/em>The attached files contain JavaScript<\/strong> <\/em>code that exploits HTML5 functionality for automatic malware downloads.<\/p>\n\n\n\n

The attack has been designated HTML Smuggling<\/strong>.<\/p>\n\n\n\n

HTML Smuggling Attack Phases<\/h2>\n\n\n\n
\"\"
HTML Smuggling attack phases – Source: Microsoft<\/a><\/figcaption><\/figure>\n\n\n\n

The attack consists of a series of automated steps that enable automatic download of a JavaScript Blob<\/strong><\/em> following complete page load. Within the HTML code, a link is inserted (via code or through the <a> tag) to which the download<\/strong><\/em> property<\/span> is associated, which allows a file to be saved to disk, preventing direct opening by the browser. Below is an example in HTML of a link with the download<\/strong><\/em> property.<\/em><\/p>\n\n\n\n

<a href=\"\/archivio\/malevolo.zip\" download=\"malware.zip\">Click here<\/a><\/pre>\n\n\n\n
Within the same file\/site, JavaScript code is present whose task is to assemble the malicious file and download it automatically. The file is constructed via a Blob<\/strong><\/em> and associated with the link, all through the same code.<\/em><\/p>\n\n\n\n
var anchorLink = document.createElement('a');\nanchorLink.download = 'malicious_file.zip';\nvar blob = new Blob([malicious_data], {type: 'octet\/stream'});\nvar url = window.URL.createObjectUrl(blob);\nanchorLink.href = url;\nanchorLink.download();<\/pre>\n\n\n\n
In malware campaigns, malicious content is typically downloaded in the form of a password-protected archive. This enables evasion of automated scanning systems that analyze the contents of downloaded archives. Our Cyber Threat Intelligence<\/a> operations have tracked this technique across multiple threat actors leveraging HTML Smuggling to bypass perimeter defenses.<\/p>\n\n\n\n
Opening the contents of the .zip file by the user initiates a series of commands (typically PowerShell or VisualBasic scripts) for download and execution of the malware (final stage).<\/p>\n\n\n\n
Among these, the known malware TrickBot<\/strong> has been observed targeting multiple Italian organizations, demonstrating the operational effectiveness of HTML Smuggling as a delivery mechanism for banking trojans and loader payloads.<\/p>\n","protected":false},"excerpt":{"rendered":"
HTML Smuggling: payload assembly client-side from JavaScript-encoded blobs, perimeter-bypass mechanics and detection considerations for email and web gateways.<\/p>\n","protected":false},"author":1,"featured_media":3377,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[3263,1587,1589,1591,1439,1593,1441,3264,3262,3265],"class_list":["post-3372","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-emerging-threats","tag-defense-evasion","tag-html-smuggling-it","tag-html5-it","tag-javascript-it","tag-malware-it","tag-malware-zip-it","tag-phishing-it","tag-phishing-delivery","tag-t1027-006","tag-web-gateway-bypass"],"_links":{"self":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/3372","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/comments?post=3372"}],"version-history":[{"count":3,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/3372\/revisions"}],"predecessor-version":[{"id":9894,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/3372\/revisions\/9894"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/media\/3377"}],"wp:attachment":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/media?parent=3372"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/categories?post=3372"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/tags?post=3372"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}