High Severity
Attachment: HTML smuggling with excessive line break obfuscation
Description
Credential Phishing attacks have been observed using excessive line breaks to obfuscate javascript functions within html files.
References
No references.
Sublime Security
Created Sep 8th, 2023 • Last updated Sep 8th, 2023
Feed Source
Sublime Core Feed
Source
type.inbound
and any(attachments,
(
.file_extension in~ ("html", "htm", "shtml", "dhtml")
or .file_extension in~ $file_extensions_common_archives
or .file_type == "html"
)
and any(file.explode(.),
any(.scan.strings.strings,
// return new line padded obfuscation
regex.contains(., '(\\r\\n\S{2}){50,}')
and strings.contains(., 'decodeURIComponent')
)
)
)
Playground
Test against your own EMLs or sample data.