HTML Smuggling on Rise

Microsoft warn that threat actors are increasingly using HTML smuggling technique in phishing campaigns to stealthily deliver threats.

HTML smuggling is a highly evasive technique for malware delivery that leverages legitimate HTML5 and JavaScript features. The malicious payloads are delivered via encoded strings in an HTML attachment or webpage. The malicious HTML code is generated within the browser on the target device which is already inside the security perimeter of the victim’s network.  

HTML smuggling lets an attacker “smuggle” an encoded malicious script within a specially crafted HTML attachment or web page. When a target user opens the HTML in their web browser, the browser decodes the malicious script, which, in turn, assembles the payload on the host device.Thus, instead of having a malicious executable pass directly through a network, the attacker builds the malware locally behind a firewall.

The emails employed in the campaign attributed to DEV-0193 used a specially crafted HTML page as an attachment.

Once opened the attachment in a web browser, it creates a password-protected JavaScript file on the recipient’s system, asking the victim to provide the password from the original HTML attachment.

Upon executing the JavaScript code, it will launch a Base64-encoded PowerShell command that fetches the TrickBot payload from a served under the control of the attackers.

Threats that use HTML smuggling relies on legitimate uses of HTML and JavaScript in business operations to stay hidden and relevant, as well as challenge organizations’ conventional mitigation procedures. There are multiple ways to implement HTML smuggling through obfuscation and numerous ways of coding JavaScript, making the said technique highly evasive against content inspection.

Organizations need a true “defense in depth” strategy and a multi-layered security solution that inspects email delivery, network activity, endpoint behavior, and follow-on attacker activities