Sublime Security

Sublime Core Feed
HTML analysis
Learn More
Login to Sublime
Attack Types
BEC/Fraud
Callback Phishing
Credential Phishing
Extortion
Malware/Ransomware
Reconnaissance
Spam
Tactics and Techniques
Encryption
Evasion
Exploit
Free email provider
Free file host
Free subdomain host
HTML smuggling
ICS Phishing
Image as content
Impersonation: Brand
Impersonation: Employee
Impersonation: VIP
IPFS
ISO
LNK
Lookalike domain
Macros
OneNote
Open redirect
Out of band pivot
PDF
Punycode
QR code
Scripting
Social engineering
Spoofing
Detection Methods
Archive analysis
Content analysis
Computer Vision
Exif analysis
File analysis
Header analysis
HTML analysis
Javascript analysis
Macro analysis
Natural Language Understanding
Optical Character Recognition
OLE analysis
PDF analysis
QR code analysis
Sender analysis
Threat intelligence
URL analysis
URL screenshot
Whois
XML analysis
YARA
Detection Method: HTML analysis
HTML analysis looks at the HTML code in emails, web pages, or attachments to spot potentially malicious elements or deceptive structures. It examines both what’s visible and hidden in the HTML to uncover tactics often used in phishing or malware attacks.
HTML analysis can help you detect:
Hidden scripts or iframes that might run harmful code
Obfuscated JavaScript designed to avoid detection
Misleading hyperlinks where the displayed text doesn’t match the real URL
Forms made to steal credentials or sensitive data
Suspicious HTML comments with hidden instructions
CSS tricks used to hide malicious content
For example, phishing emails often use HTML to replicate trusted login pages. HTML analysis can catch the hidden forms and scripts trying to steal your credentials.
Blog Posts
Talking phish over turkey · Blog · Sublime Security
Living Off the Land: Credential Phishing via Docusign abuse · Blog · Sublime Security
Call Me Maybe? The Rise of Callback Phishing Emails · Blog · Sublime Security
Attack Types (6):
Credential Phishing
BEC/Fraud
Malware/Ransomware
Spam
Callback Phishing
Extortion
Tactics & Techniques (23):
Social engineering
Impersonation: Brand
Image as content
Out of band pivot
Evasion
Exploit
Scripting
PDF
Free email provider
HTML smuggling
Spoofing
Free file host
Lookalike domain
Free subdomain host
Open redirect
Impersonation: VIP
ICS Phishing
Credential Phishing
HTML injection
Encryption
Impersonation: Employee
OneNote
ISO
Rule Name & Severity
Last Updated
Types, Tactics & Capabilities
Link: Fake Cloudflare verification landing page
5d ago
Sep 11th, 2026
Sublime Security
Credential Phishing
Social engineering
URL analysis
HTML analysis
Header analysis
Content analysis
Credential Phishing
Social engineering
URL analysis
HTML analysis
Header analysis
Content analysis
Impersonation: SAM/SBA federal registration
5d ago
Sep 11th, 2026
Sublime Security
Credential Phishing
BEC/Fraud
Impersonation: Brand
Social engineering
Image as content
Sender analysis
Content analysis
HTML analysis
Header analysis
Credential Phishing
BEC/Fraud
Impersonation: Brand
Social engineering
Image as content
Sender analysis
Content analysis
HTML analysis
Header analysis
Service abuse: Self-service platform redirecting to newly registered suspicious domain
6d ago
Sep 10th, 2026
Sublime Security
Credential Phishing
Out of band pivot
Evasion
URL analysis
Whois
HTML analysis
Credential Phishing
Out of band pivot
Evasion
URL analysis
Whois
HTML analysis
Link: Fake webmail hosting
7d ago
Sep 9th, 2026
Sublime Security
Credential Phishing
Social engineering
HTML analysis
URL analysis
Credential Phishing
Social engineering
HTML analysis
URL analysis
Body: CVE-2026-42897 Exchange OWA stored XSS
7d ago
Sep 9th, 2026
Sublime Security
Malware/Ransomware
Evasion
Exploit
Scripting
Content analysis
HTML analysis
Malware/Ransomware
Evasion
Exploit
Scripting
Content analysis
HTML analysis
Attachment: PDF with bolded passcode
8d ago
Sep 8th, 2026
Sublime Security
Credential Phishing
PDF
Evasion
Social engineering
HTML analysis
Content analysis
File analysis
Credential Phishing
PDF
Evasion
Social engineering
HTML analysis
Content analysis
File analysis
Attachment: Word document with hyperlink and fraud language
12d ago
Sep 4th, 2026
Sublime Security
Credential Phishing
BEC/Fraud
Free email provider
Social engineering
Evasion
File analysis
XML analysis
HTML analysis
URL analysis
Natural Language Understanding
Sender analysis
Credential Phishing
BEC/Fraud
Free email provider
Social engineering
Evasion
File analysis
XML analysis
HTML analysis
URL analysis
Natural Language Understanding
Sender analysis
Credential phishing: Suspicious e-sign agreement document notification
12d ago
Sep 4th, 2026
Sublime Security
Credential Phishing
Social engineering
Content analysis
Header analysis
HTML analysis
URL analysis
Sender analysis
Credential Phishing
Social engineering
Content analysis
Header analysis
HTML analysis
URL analysis
Sender analysis
Attachment: Gzip-archived with nested HTML file containing image and button link
13d ago
Sep 3rd, 2026
Sublime Security
Credential Phishing
HTML smuggling
Image as content
Evasion
Archive analysis
YARA
HTML analysis
URL analysis
File analysis
Credential Phishing
HTML smuggling
Image as content
Evasion
Archive analysis
YARA
HTML analysis
URL analysis
File analysis
Body: CSS Hidden text via table-column
13d ago
Sep 3rd, 2026
Sublime Security
Credential Phishing
Spam
Evasion
HTML analysis
Content analysis
Credential Phishing
Spam
Evasion
HTML analysis
Content analysis
Link: Gmail phishkit with suspicious recipient
14d ago
Sep 2nd, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Evasion
Social engineering
URL analysis
HTML analysis
Sender analysis
Credential Phishing
Impersonation: Brand
Evasion
Social engineering
URL analysis
HTML analysis
Sender analysis
Attachment: GZ archive with credential theft content
14d ago
Sep 2nd, 2026
Sublime Security
Credential Phishing
Evasion
Archive analysis
File analysis
YARA
Natural Language Understanding
HTML analysis
URL analysis
Credential Phishing
Evasion
Archive analysis
File analysis
YARA
Natural Language Understanding
HTML analysis
URL analysis
Body: CSS clamp() font obfuscation
15d ago
Sep 1st, 2026
Sublime Security
Credential Phishing
Evasion
Social engineering
HTML analysis
URL analysis
Content analysis
Credential Phishing
Evasion
Social engineering
HTML analysis
URL analysis
Content analysis
Body HTML: Comment with 24-character hex token
15d ago
Sep 1st, 2026
Sublime Security
Spam
Evasion
Content analysis
HTML analysis
Spam
Evasion
Content analysis
HTML analysis
Evasion: Hidden text using CSS-obscured HTML option labels
15d ago
Sep 1st, 2026
Sublime Security
Credential Phishing
Evasion
Social engineering
Impersonation: Brand
HTML analysis
URL analysis
Content analysis
Credential Phishing
Evasion
Social engineering
Impersonation: Brand
HTML analysis
URL analysis
Content analysis
Brand impersonation: Paperless Post
16d ago
Aug 31st, 2026
Sublime Security
Credential Phishing
Malware/Ransomware
Impersonation: Brand
Content analysis
Header analysis
HTML analysis
Sender analysis
URL analysis
Credential Phishing
Malware/Ransomware
Impersonation: Brand
Content analysis
Header analysis
HTML analysis
Sender analysis
URL analysis
Service abuse: EventCreate links to newly registered domains
16d ago
Aug 31st, 2026
Sublime Security
Credential Phishing
Out of band pivot
URL analysis
Whois
HTML analysis
Credential Phishing
Out of band pivot
URL analysis
Whois
HTML analysis
HTML: Bidirectional (BIDI) HTML override with right to left obfuscation
16d ago
Aug 31st, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Evasion
Social engineering
Scripting
Content analysis
HTML analysis
BEC/Fraud
Credential Phishing
Evasion
Social engineering
Scripting
Content analysis
HTML analysis
Link: Credential harvesting with excess padding evasion
19d ago
Aug 28th, 2026
Sublime Security
Credential Phishing
Evasion
Social engineering
Content analysis
HTML analysis
Exif analysis
URL screenshot
Credential Phishing
Evasion
Social engineering
Content analysis
HTML analysis
Exif analysis
URL screenshot
Body: HTML whitespace stuffing with short initial message
19d ago
Aug 28th, 2026
Sublime Security
Credential Phishing
Evasion
Social engineering
Content analysis
HTML analysis
Header analysis
Credential Phishing
Evasion
Social engineering
Content analysis
HTML analysis
Header analysis
Page 1 of 9

Rule Name & Severity	Last Updated	Author	Types, Tactics & Capabilities
Link: Fake Cloudflare verification landing page	5d ago Sep 11th, 2026	Sublime Security	Credential Phishing Social engineering URL analysis HTML analysis Header analysis Content analysis
Impersonation: SAM/SBA federal registration	5d ago Sep 11th, 2026	Sublime Security	Credential Phishing BEC/Fraud Impersonation: Brand Social engineering Image as content Sender analysis Content analysis HTML analysis Header analysis
Service abuse: Self-service platform redirecting to newly registered suspicious domain	6d ago Sep 10th, 2026	Sublime Security	Credential Phishing Out of band pivot Evasion URL analysis Whois HTML analysis
Link: Fake webmail hosting	7d ago Sep 9th, 2026	Sublime Security	Credential Phishing Social engineering HTML analysis URL analysis
Body: CVE-2026-42897 Exchange OWA stored XSS	7d ago Sep 9th, 2026	Sublime Security	Malware/Ransomware Evasion Exploit Scripting Content analysis HTML analysis
Attachment: PDF with bolded passcode	8d ago Sep 8th, 2026	Sublime Security	Credential Phishing PDF Evasion Social engineering HTML analysis Content analysis File analysis
Attachment: Word document with hyperlink and fraud language	12d ago Sep 4th, 2026	Sublime Security	Credential Phishing BEC/Fraud Free email provider Social engineering Evasion File analysis XML analysis HTML analysis URL analysis Natural Language Understanding Sender analysis
Credential phishing: Suspicious e-sign agreement document notification	12d ago Sep 4th, 2026	Sublime Security	Credential Phishing Social engineering Content analysis Header analysis HTML analysis URL analysis Sender analysis
Attachment: Gzip-archived with nested HTML file containing image and button link	13d ago Sep 3rd, 2026	Sublime Security	Credential Phishing HTML smuggling Image as content Evasion Archive analysis YARA HTML analysis URL analysis File analysis
Body: CSS Hidden text via table-column	13d ago Sep 3rd, 2026	Sublime Security	Credential Phishing Spam Evasion HTML analysis Content analysis
Link: Gmail phishkit with suspicious recipient	14d ago Sep 2nd, 2026	Sublime Security	Credential Phishing Impersonation: Brand Evasion Social engineering URL analysis HTML analysis Sender analysis
Attachment: GZ archive with credential theft content	14d ago Sep 2nd, 2026	Sublime Security	Credential Phishing Evasion Archive analysis File analysis YARA Natural Language Understanding HTML analysis URL analysis
Body: CSS clamp() font obfuscation	15d ago Sep 1st, 2026	Sublime Security	Credential Phishing Evasion Social engineering HTML analysis URL analysis Content analysis
Body HTML: Comment with 24-character hex token	15d ago Sep 1st, 2026	Sublime Security	Spam Evasion Content analysis HTML analysis
Evasion: Hidden text using CSS-obscured HTML option labels	15d ago Sep 1st, 2026	Sublime Security	Credential Phishing Evasion Social engineering Impersonation: Brand HTML analysis URL analysis Content analysis
Brand impersonation: Paperless Post	16d ago Aug 31st, 2026	Sublime Security	Credential Phishing Malware/Ransomware Impersonation: Brand Content analysis Header analysis HTML analysis Sender analysis URL analysis
Service abuse: EventCreate links to newly registered domains	16d ago Aug 31st, 2026	Sublime Security	Credential Phishing Out of band pivot URL analysis Whois HTML analysis
HTML: Bidirectional (BIDI) HTML override with right to left obfuscation	16d ago Aug 31st, 2026	Sublime Security	BEC/Fraud Credential Phishing Evasion Social engineering Scripting Content analysis HTML analysis
Link: Credential harvesting with excess padding evasion	19d ago Aug 28th, 2026	Sublime Security	Credential Phishing Evasion Social engineering Content analysis HTML analysis Exif analysis URL screenshot
Body: HTML whitespace stuffing with short initial message	19d ago Aug 28th, 2026	Sublime Security	Credential Phishing Evasion Social engineering Content analysis HTML analysis Header analysis