{"id":33701,"date":"2022-05-17T14:04:39","date_gmt":"2022-05-17T11:04:39","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=33701"},"modified":"2026-03-28T00:54:17","modified_gmt":"2026-03-27T21:54:17","slug":"please-review-the-attached-file-using-html-attachments-allows-phishers-to-avoid-detection","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/please-review-the-attached-file-using-html-attachments-allows-phishers-to-avoid-detection\/","title":{"rendered":"\ufffc\u201cPlease review the attached file\u201d: Using HTML attachments allows phishers to avoid detection"},"content":{"rendered":"\n

Kaspersky experts warn users about the growing threat coming from the increased numbers of phishing emails containing HTML files. From January to April 2022, Kaspersky researchers blocked nearly 2 million phishing emails containing HTML attachments. Using HTML files in phishing letters is one of the latest and popular tricks abused by fraudsters. Usually, such links are easily detected by anti-spam engines or antivirus software but using HTML attachments has allowed cybercriminals to avoid detection. <\/strong><\/p>\n\n\n\n

Many users aren\u2019t even aware that files in phishing emails can be insecure, so they unsuspectingly open these HTML attachments, which turn out to be dangerous and targeted weapons used by cybercriminals. <\/strong>Fraudsters can stylize HTML attachments to make them look identical to the pages on a company\u2019s official website. They target the official website\u2019s users and copy its style, images, scripts and other multimedia components, using it as bait to trick their victims into entering vulnerable data in the phishing form.<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

Cybercriminals lure victims into opening malicious HTML attachments, claiming that the file is only safe through this link<\/em><\/p>\n\n\n\n

There are two main types of HTML attachments used by cybercriminals: HTML files with a phishing link or entire malicious pages. In the first case, attackers will send an HTML file with text inside, claiming to have important data, such as a bank\u2019s notification about a large transfer attempt. The user is prompted to click on a link to the bank’s site, to stop the transaction, which instead leads to a phishing page. In some cases, the victim doesn\u2019t even have to click the link. When the user tries to open the HTML attachment, it will automatically redirect them to a malicious site. Once on this page, victims are requested to fill out a data-entry form to review business-related files, protect their bank account or even receive a government payment. It is only later that the victim finds out they\u2019ve had their personal data and bank details stolen.<\/p>\n\n\n\n

The second type of HTML attachments are entire phishing pages. These files allow cybercriminals to save on hosting fees and avoid using websites because the phishing form and the script used to collect data are fully contained within the attachment. Used as a phishing site, the HTML file can also be personalized, depending on the intended target and the attack vector used to gain the victim\u2019s trust. For example, a fraudster could distribute a phishing email among the employees of a company, appearing as though it\u2019s asking to verify a contract, but is actually a malicious HTML file. Such attachments will have all the visual attributes of that company: logo, style and even the name of the boss as its sender. Inside the file, the victim is requested to enter the login and password for their corporate account in order to access the document. This data then falls directly into the hands of the cybercriminal, who can use this information to break into the company’s corporate network.<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

An example of a phishing page in the HTML attachment<\/em><\/p>\n\n\n\n

While security solutions can already block emails containing HTML attachments with malicious scripts or phishing links in plain text, cybercriminals are now using different tactics to avoid being blocked. For example, fraudsters often distort the phishing link or the whole HTML file with muddled or garbage code. Although this junk and incoherent text doesn\u2019t appear on the user’s screen, it still makes it harder for anti-spam engines to detect and consequently block the email. <\/p>\n\n\n\n

\u201cCybercriminals use cleverly disguised requests for login credentials to dupe unsuspecting victims into entering their usernames and passwords.\u00a0Every year we block millions of phishing pages and this number is only expected to grow, meaning users must stay alert and be aware of the danger that these emails can bring.\u00a0Cybercriminals have created a complex and advanced infrastructure where even novice scammers can create thousands of phishing pages, using<\/em>ready-made templates<\/em><\/a>,\u00a0then target a vast range of users. With any amateur now able to create his own phishing page, you have to be particularly careful when opening any links from an email or messaging service\u201d,<\/em>\u00a0comments Roman Dedenok, security researcher at Kaspersky.<\/p>\n\n\n\n

Read the full report about the phishing HTML attachments on Securelist.<\/p>\n\n\n\n

To protect yourself from phishing, Kaspersky recommends:<\/strong><\/p>\n\n\n\n