Tactic or Technique: HTML smuggling

HTML smuggling is a stealthy way for attackers to deliver malware by hiding it inside HTML files either in emails or linked web pages. Instead of attaching a file directly, the attacks use JavaScript to build the malicious payload inside your browser after it’s already passed through security filters encoded or encrypted.

The trick works because the email or link doesn’t look dangerous on its own. Security tools see harmless HTML and JavaScript, but once you open the file or click the link, your browser assembles and downloads the real malware—completely bypassing traditional scans.

Attackers often use this to deliver ransomware, credential harvesters, or remote access tools. The malicious code is usually Base64-encoded or obfuscated in the HTML, then decoded and executed using legitimate browser functions. It’s been used in targeted campaigns against businesses, especially when attackers want to avoid detection while still delivering high-impact payloads.