https://www.xorlab.com/en/blog/html-smuggling-how-malicious-actors-use-javascript-and-html-to-fly-under-the-radar
xorlab_logo_black_svg_HS_nomargin
* Product
* Company
+ About
+ Team
+ Contact
+ Careers
* Partners
* Resources
Get Free Guide to Smarter Email Security BOOK A DEMO
Phishing
HTML smuggling: How malicious actors use JavaScript and HTML to fly
under the radar
Max
Jun 27, 2023
Phishing HTML Smuggling Tactics
[blog]
HTML smuggling started to pop up in 2021 as a serious elusive loader
technique used by threat actors to deploy remote access trojans
(RATs), malware and other malicious payloads on victims computers.
Even though HTML smuggling takes many different shapes and forms, the
technique usually follows the same pattern:
1. An email is sent to the victim containing a HTML file (either
directly attached or compressed into an archive)
2. The email tries to project a sense of trust and urgency, and
points the victim towards opening the attached HTML file.
Frequently seen "urgency techniques" are Payments notifications,
Document sharing, Document signing, Shipping notifications and
Missed calls.
3. When the HTML file is opened, JavaScript is executed in the
browser. What the JavaScript does varies between attacks. It
could for example:
1. Prompt the user to enter some credentials that then get sent
off to an external malicious server.
2. Package inlined or streamed malicious data into a file, which
the user is urged to download and open.
HTML-smuggling example
HTML-smuggling example
HTML smuggling seen in the wild
There are plenty of articles written that analyze the different
malware deployed through HTML smuggling. In this article, we will
instead do a large-scale analysis of JavaScript and HTML
functionality that we frequently see in HTML smuggling but rarely in
legitimate business communication. The analysis was performed on data
collected from 14 large organizations, within varying industries and
sectors. The data was collected over a period of 3 months, and during
that time, 9617 malicious and 2229 legitimate emails containing HTML
attachments with JavaScript were seen.
Based on this analysis, we will give some recommendations of simple
but effective ways to improve your organization's protection against
HTML smuggling.
JavaScript and HTML functionality seen in HTML smuggling
Note that all the code examples are benign (either created by us or
defanged)
HTML smuggling attacks commonly use default JavaScript and HTML
functionality to obfuscate parts of the HTML file. This could for
example be to obfuscate inlined data, the domain/IP of a malicious
server or to hide JavaScript logic. Here are the 4 most common
JavaScript and HTML functionalities that we've seen being used in
HTML smuggling attacks.
Decoding functions
Decoding functions is one of the most commonly seen obfuscation
techniques, where atob(), decodeURIComponent(), decodeURI(), unescape
() and String.fromCharCode() are topping the list.
Here's a dummy example containing pseudo-code, illustrating how a URL
can be obfuscated and decoded using multiple nested atob():
a = atob(
atob('YUhSMGNITTZMeTkwYUdseg==') +
atob('WTI5dWRHRnBibk50WVd4cA==') +
atob('WTJsdmRYTmpiMjUwWlc1MA==') +
atob('TWpRMk9ERXdMbU52YlE9PQ==')
)
a == "https://thiscontainsmaliciouscontent246810.com" // True
Document write
To hide HTML content, it's common for malicious actors to obfuscate
parts or the complete content by converting it into a single
will result in:
HELLO
Data object creation
Data object creation is a technique used to make a HTML file
construct and download a malicious payload to the victim's computer.
File, Blob, createObjectURL and revokeObjectURL are often used
together to construct a file. This is a technique that has been seen
used to smuggle e.g. Qakbot.
In this dummy example, the variable dummyMaliciousData contains
Base64-encoded bytes of a dummy ZIP-file. When the HTML file is
opened by the victim, the inlined Base64-encoded ZIP-file gets
reverted into the original ZIP-file and a download-popup is
triggered.
Here's a real-world example of data object creation being used in
HTML smuggling:
Screenshot 2023-06-18 at 21.31.123
Data URLs
Another way used to inline and obfuscate HTML/JavaScript in HTML
smuggling is Data URLs. In benign HTML, Data URLs are commonly used
to inline e.g. images:
But as these URLs allow the user to define the MIME-type, they are
also seen used by malicious actors to smuggle JavaScript, either
directly by using the MIME-type application/javascript or through a
SVG-image (image/svg+xml), which supports JavaScript execution.
In this example, we've Base64-encoded the following SVG-image, which
contains JavaScript:
The Base64-encoded SVG-image is then inlined using an
But as these URLs allow the user to define the MIME-type, they are
also seen used by malicious actors to smuggle JavaScript, either
directly by using the MIME-type application/javascript or through a
SVG-image (image/svg+xml), which supports JavaScript execution.
In this example, we've Base64-encoded the following SVG-image, which
contains JavaScript:
The Base64-encoded SVG-image is then inlined using an