Detection Method: Javascript analysis

JavaScript analysis inspects JavaScript code found in email messages, HTML attachments, and linked web pages to identify potential malicious behavior or suspicious patterns. It uses specialized techniques to spot obfuscated scripts, malicious functions, and known attack strategies.
JavaScript analysis can help you detect:
  • Obfuscated code designed to hide malicious intent
  • DOM manipulation attempts that lead to phishing or data theft
  • Event handlers that trigger actions when content is viewed
  • Suspicious API calls like document.write() or eval() that generate malicious content
  • Encoded strings that decode to payloads during runtime
For example, attackers often use obfuscated JavaScript to redirect you to phishing sites or to download malware. JavaScript analysis can uncover these threats even when the code is intentionally hidden.
Blog Post
Talking phish over turkey · Blog · Sublime Security
Talking phish over turkey · Blog · Sublime Security
Sublime Security Attack Spotlight: Year-end credential phishing attacks.
Attack Types (3):
Credential Phishing
Malware/Ransomware
BEC/Fraud
Tactics & Techniques (10):
Encryption
Evasion
HTML smuggling
Scripting
Social engineering
Free subdomain host
Impersonation: Brand
Out of band pivot
Free file host
Open redirect
Rule Name & Severity
Last Updated
Author
Types, Tactics & Capabilities
Attachment: HTML smuggling with ROT13
1mo ago
Dec 2nd, 2025
@Kyle_Parrish_
Credential Phishing
Malware/Ransomware
Encryption
Evasion
HTML smuggling
Scripting
Archive analysis
Content analysis
File analysis
Javascript analysis
HTML analysis
/feeds/core/detection-rules/attachment-html-smuggling-with-rot13-6eacc4cf
Link: Multistage landing - JotForm abuse
1mo ago
Dec 1st, 2025
Sublime Security
Credential Phishing
Evasion
Social engineering
Content analysis
HTML analysis
Javascript analysis
URL analysis
/feeds/core/detection-rules/link-multistage-landing-jotform-abuse-5b64326f
Link: Cryptocurrency fraud with suspicious links
1mo ago
Dec 1st, 2025
Sublime Security
BEC/Fraud
Social engineering
Evasion
Free subdomain host
Scripting
Content analysis
Header analysis
Javascript analysis
Natural Language Understanding
Sender analysis
URL analysis
URL screenshot
Whois
/feeds/core/detection-rules/link-cryptocurrency-fraud-with-suspicious-links-d0da37ce
Attachment: HTML smuggling with base64 encoded ZIP file
1mo ago
Nov 20th, 2025
Sublime Security
Credential Phishing
Malware/Ransomware
Evasion
HTML smuggling
Scripting
Archive analysis
Content analysis
File analysis
HTML analysis
Javascript analysis
/feeds/core/detection-rules/attachment-html-smuggling-with-base64-encoded-zip-file-47e388de
Attachment: HTML smuggling with atob and high entropy
1mo ago
Nov 4th, 2025
Sublime Security
Credential Phishing
Malware/Ransomware
HTML smuggling
Scripting
Archive analysis
Content analysis
File analysis
HTML analysis
Javascript analysis
Sender analysis
URL analysis
/feeds/core/detection-rules/attachment-html-smuggling-with-atob-and-high-entropy-03fcac11
Attachment: HTML file with reference to recipient and suspicious patterns
1mo ago
Nov 4th, 2025
Sublime Security
Credential Phishing
HTML smuggling
Scripting
Content analysis
File analysis
HTML analysis
Javascript analysis
YARA
/feeds/core/detection-rules/attachment-html-file-with-reference-to-recipient-and-suspicious-patterns-5333493d
Attachment: EML file contains HTML attachment with login portal indicators
1mo ago
Nov 4th, 2025
Sublime Security
Credential Phishing
Evasion
HTML smuggling
Content analysis
File analysis
Header analysis
HTML analysis
Javascript analysis
Sender analysis
/feeds/core/detection-rules/attachment-eml-file-contains-html-attachment-with-login-portal-indicators-6e4df158
Attachment: HTML with obfuscation and recipient's email in JavaScript strings
3mo ago
Sep 25th, 2025
Sublime Security
Credential Phishing
HTML smuggling
Scripting
Archive analysis
File analysis
HTML analysis
Javascript analysis
/feeds/core/detection-rules/attachment-html-with-obfuscation-and-recipients-email-in-javascript-strings-1aff486b
Attachment: HTML smuggling with eval and atob via calendar invite
3mo ago
Sep 25th, 2025
Sublime Security
Credential Phishing
Malware/Ransomware
Evasion
HTML smuggling
Scripting
File analysis
HTML analysis
Javascript analysis
/feeds/core/detection-rules/attachment-html-smuggling-with-eval-and-atob-via-calendar-invite-597c2edd
Attachment: EML with embedded Javascript in SVG file
4mo ago
Aug 8th, 2025
Sublime Security
Credential Phishing
Malware/Ransomware
Scripting
Evasion
File analysis
Javascript analysis
Sender analysis
/feeds/core/detection-rules/attachment-eml-with-embedded-javascript-in-svg-file-dfafb78f
Attachment: HTML attachment with Javascript location
5mo ago
Aug 5th, 2025
@vector_sec
Credential Phishing
Malware/Ransomware
Evasion
HTML smuggling
Scripting
Archive analysis
Content analysis
File analysis
Javascript analysis
HTML analysis
/feeds/core/detection-rules/attachment-html-attachment-with-javascript-location-e0611295
Attachment: HTML smuggling Microsoft sign in
5mo ago
Aug 5th, 2025
Sublime Security
Credential Phishing
Free subdomain host
HTML smuggling
Impersonation: Brand
Social engineering
Archive analysis
Content analysis
File analysis
Header analysis
Javascript analysis
Sender analysis
URL analysis
/feeds/core/detection-rules/attachment-html-smuggling-microsoft-sign-in-878d6385
Attachment: HTML attachment with login portal indicators
5mo ago
Aug 5th, 2025
@ajpc500
Credential Phishing
HTML smuggling
Scripting
Archive analysis
File analysis
HTML analysis
Javascript analysis
Sender analysis
/feeds/core/detection-rules/attachment-html-attachment-with-login-portal-indicators-3aabf4a7
Attachment: HTML with JavaScript functions for HTTP requests
5mo ago
Aug 5th, 2025
Sublime Security
Credential Phishing
Evasion
Scripting
Content analysis
HTML analysis
Javascript analysis
File analysis
/feeds/core/detection-rules/attachment-html-with-javascript-functions-for-http-requests-01e679fd
Attachment: HTML with emoji-to-character map
5mo ago
Aug 5th, 2025
Sublime Security
Credential Phishing
Evasion
HTML smuggling
Impersonation: Brand
Scripting
Social engineering
File analysis
HTML analysis
Javascript analysis
Sender analysis
/feeds/core/detection-rules/attachment-html-with-emoji-to-character-map-3119d086
Link: chatbot.page platform abuse
5mo ago
Aug 5th, 2025
Sublime Security
Credential Phishing
Social engineering
Out of band pivot
URL analysis
Natural Language Understanding
Content analysis
HTML analysis
Javascript analysis
URL screenshot
/feeds/core/detection-rules/link-chatbotpage-platform-abuse-bfd6a076
Low reputation link to auto-downloaded HTML file with smuggling indicators
5mo ago
Jul 23rd, 2025
Sublime Security
Credential Phishing
Evasion
Free file host
Free subdomain host
HTML smuggling
Impersonation: Brand
Open redirect
Social engineering
Content analysis
File analysis
HTML analysis
Javascript analysis
Sender analysis
URL analysis
/feeds/core/detection-rules/low-reputation-link-to-auto-downloaded-html-file-with-smuggling-indicators-339676c6
Attachment: File execution via Javascript
5mo ago
Jul 16th, 2025
Sublime Security
Malware/Ransomware
Evasion
Scripting
Archive analysis
File analysis
Javascript analysis
Sender analysis
/feeds/core/detection-rules/attachment-file-execution-via-javascript-627ae0b1
Attachment: HTML smuggling with atob and high entropy via calendar invite
7mo ago
Jun 3rd, 2025
Sublime Security
Credential Phishing
Malware/Ransomware
Evasion
HTML smuggling
Scripting
File analysis
HTML analysis
Javascript analysis
Sender analysis
/feeds/core/detection-rules/attachment-html-smuggling-with-atob-and-high-entropy-via-calendar-invite-94d84614
Attachment: HTML smuggling with excessive string concatenation and suspicious patterns
2y ago
Aug 27th, 2024
Sublime Security
Credential Phishing
Evasion
HTML smuggling
Scripting
Social engineering
File analysis
HTML analysis
Javascript analysis
/feeds/core/detection-rules/attachment-html-smuggling-with-excessive-string-concatenation-and-suspicious-patterns-e34fce8d
Page 1 of 2