HTML Smuggling technique used in phishing and malspam campaigns

Threat actors are increasingly using the HTML smuggling technique in phishing campaigns, Microsoft researchers warn.

Microsoft experts warn that threat actors are increasingly using the HTML smuggling technique in phishing campaigns to stealthily deliver threats.

HTML smuggling is a highly evasive technique for malware delivery that leverages legitimate HTML5 and JavaScript features. The malicious payloads are delivered via encoded strings in an HTML attachment or webpage. The malicious HTML code is generated within the browser on the target device which is already inside the security perimeter of the victim’s network.  

The technique was used, for example, in a spear-phishing campaign orchestrated by the NOBELIUM APT in May. More recently, the HTML smuggling technique was used to deliver the banking Trojan Mekotio, as well as AsyncRAT/NJRAT and Trickbot. In September, Microsoft uncovered a phishing campaign, attributed to the emerging, financially motivated group DEV-0193, to deliver Trickbot.

“As the name suggests, HTML smuggling lets an attacker “smuggle” an encoded malicious script within a specially crafted HTML attachment or web page. When a target user opens the HTML in their web browser, the browser decodes the malicious script, which, in turn, assembles the payload on the host device.” reads the analysis published by Microsoft. “Thus, instead of having a malicious executable pass directly through a network, the attacker builds the malware locally behind a firewall.”

The emails employed in the campaign attributed to DEV-0193 used a specially crafted HTML page as an attachment.

Once opened the attachment in a web browser, it creates a password-protected JavaScript file on the recipient’s system, asking the victim to provide the password from the original HTML attachment.

Upon executing the JavaScript code, it will launch a Base64-encoded PowerShell command that fetches the TrickBot payload from a served under the control of the attackers.

“Threats that use HTML smuggling bank on the legitimate uses of HTML and JavaScript in daily business operations in their attempt to stay hidden and relevant, as well as challenge organizations’ conventional mitigation procedures. For example, disabling JavaScript could mitigate HTML smuggling created using JavaScript Blobs. However, JavaScript is used to render business-related and other legitimate web pages. In addition, there are multiple ways to implement HTML smuggling through obfuscation and numerous ways of coding JavaScript, making the said technique highly evasive against content inspection.” concludes the report. “Therefore, organizations need a true “defense in depth” strategy and a multi-layered security solution that inspects email delivery, network activity, endpoint behavior, and follow-on attacker activities.”

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, phishing)

[adrotate banner=”5″]

[adrotate banner=”13″]