Microsoft experts warn that threat actors are increasingly using the HTML smuggling technique in phishing campaigns to stealthily deliver threats.
The technique was used, for example, in a spear-phishing campaign orchestrated by the NOBELIUM APT in May. More recently, the HTML smuggling technique was used to deliver the banking Trojan Mekotio, as well as AsyncRAT/NJRAT and Trickbot. In September, Microsoft uncovered a phishing campaign, attributed to the emerging, financially motivated group DEV-0193, to deliver Trickbot.
“As the name suggests, HTML smuggling lets an attacker “smuggle” an encoded malicious script within a specially crafted HTML attachment or web page. When a target user opens the HTML in their web browser, the browser decodes the malicious script, which, in turn, assembles the payload on the host device.” reads the analysis published by Microsoft. “Thus, instead of having a malicious executable pass directly through a network, the attacker builds the malware locally behind a firewall.”
The emails employed in the campaign attributed to DEV-0193 used a specially crafted HTML page as an attachment.
(SecurityAffairs – hacking, phishing)