High Severity

Attachment: Gzip-archived with nested HTML file containing image and button link

Labels

Credential Phishing

HTML smuggling

Description

Flags messages containing a gzip attachment that unpacks to an HTML file (identified via YARA), or messages whose body contains a base64-encoded image alongside an anchor tag styled as a rounded button, where the link's underlying domain resolves to a valid address. This pattern is commonly used to disguise phishing content and evade detection by embedding the malicious link within an image-styled button or compressed HTML payload.

References

No references.

Sublime Security

Created Sep 3rd, 2026 • Last updated Sep 3rd, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and any(filter(attachments, .file_type == "gz"),
        any(file.explode(.),
            any(.flavors.yara, . == "html_file")
            and strings.icontains(.scan.strings.raw, "data:image")
            and any(html.xpath(strings.parse_html(.scan.strings.raw),
                               '//a[.//span[contains(@style,"border-radius")]]/@href'
                    ).nodes,
                    strings.parse_url(.raw).domain.valid
            )
        )
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.