Clisec
ProductsAnti-spamPrecise filtering of spam and bulk campaigns, without penalizing legitimate mail.Anti-phishing & BECStops impersonation, malicious links, and email fraud before the inbox.cPanel® pluginOne agent protects the whole server; each user manages from their cPanel.Explore
PricingGuidesContactAbout us
Start freeLog in
Guide · HTML smuggling

HTML smuggling: HTML attachments that assemble malware when opened

What HTML smuggling is, how an HTML attachment rebuilds a malicious file in the browser without passing through the filter, and how to protect against it.

Updated on 5 min readClisec team

In short

In HTML smuggling, the email carries an HTML attachment (or a link to a page) that contains malware encoded as text. When opened, the browser reassembles it and downloads it onto the computer. Since the mail filter only sees an HTML page and not an executable, it often lets it through. It's detected by examining HTML attachments and the scripts that rebuild files when opened.

How it works

  1. The email carries a .html or .htm attachment, sometimes named something like "invoice" or "scanned document."
  2. Inside the file is a script with the malware encoded, for example in Base64, and sometimes split into parts.
  3. When opened, the browser runs the script, reassembles the file, and offers it as a download, usually a ZIP or a disk image (ISO).
  4. If the person opens that file, the malware installs.

A variant uses the same HTML attachment to show a fake login page without leaving the computer. See credential phishing.

Why it evades filters

  • The filter sees a text file, not an executable: there's nothing to compare against a virus signature.
  • The malicious file is created on the user's computer, after the email has already passed every check.
  • The encoded content changes with every send, so signatures don't help.

Warning signs

  • An HTML attachment in an email claiming to carry an invoice, a fax, or a document.
  • Opening it causes the browser to download a file automatically.
  • The downloaded file is a password-protected ZIP, an ISO, or a shortcut (.lnk).

How to protect yourself

  • Treat any HTML attachment as suspicious: legitimate documents rarely arrive in that format.
  • On company computers, avoid letting ISO and IMG files mount with a double-click if they're not used.
  • Use a filter that examines the content of HTML attachments. Clisec examines HTML attachments and the scripts that rebuild malicious files when opened, and sends suspicious attachments to a sandbox.

Frequently asked questions

Does antivirus software detect HTML smuggling?

It can detect the final file once downloaded, but not always. In the email itself, a signature-based antivirus usually sees just a harmless HTML file.

Can I block all HTML attachments?

That's a valid measure if your organization doesn't use them. Some legitimate systems do send HTML, so it's worth checking first.

Protect every account on your server

Clisec examines HTML attachments and the scripts that rebuild malicious files, across every account on your cPanel server.

Request a demoSee pricing and coverage

Keep reading

Guide · MalwareMalicious attachments: email malware and sandbox analysisMacros, password-protected archives and disk images: how malware arrives and how it gets analyzed in a sandbox.ReadGuide · Credential theftCredential phishing: fake login pages"Your mailbox is full" alerts and fake webmail pages: how to recognize them and what to do if someone fell for it.Read