Detection Method: Javascript analysis

JavaScript analysis inspects JavaScript code found in email messages, HTML attachments, and linked web pages to identify potential malicious behavior or suspicious patterns. It uses specialized techniques to spot obfuscated scripts, malicious functions, and known attack strategies.
JavaScript analysis can help you detect:
  • Obfuscated code designed to hide malicious intent
  • DOM manipulation attempts that lead to phishing or data theft
  • Event handlers that trigger actions when content is viewed
  • Suspicious API calls like document.write() or eval() that generate malicious content
  • Encoded strings that decode to payloads during runtime
For example, attackers often use obfuscated JavaScript to redirect you to phishing sites or to download malware. JavaScript analysis can uncover these threats even when the code is intentionally hidden.
Blog Post
Talking phish over turkey · Blog · Sublime Security
Talking phish over turkey · Blog · Sublime Security
Sublime Security Attack Spotlight: Year-end credential phishing attacks.
Attack Types (2):
Credential Phishing
Malware/Ransomware
Tactics & Techniques (10):
HTML smuggling
Scripting
Evasion
Social engineering
Out of band pivot
Free subdomain host
Impersonation: Brand
Free file host
Open redirect
Encryption
Rule Name & Severity
Last Updated
Author
Types, Tactics & Capabilities
Attachment: HTML file with reference to recipient and suspicious patterns
8d ago
Nov 4th, 2025
Sublime Security
Credential Phishing
HTML smuggling
Scripting
Content analysis
File analysis
HTML analysis
Javascript analysis
YARA
/feeds/core/detection-rules/attachment-html-file-with-reference-to-recipient-and-suspicious-patterns-5333493d
Attachment: HTML smuggling with atob and high entropy
8d ago
Nov 4th, 2025
Sublime Security
Credential Phishing
Malware/Ransomware
HTML smuggling
Scripting
Archive analysis
Content analysis
File analysis
HTML analysis
Javascript analysis
Sender analysis
URL analysis
/feeds/core/detection-rules/attachment-html-smuggling-with-atob-and-high-entropy-03fcac11
Attachment: EML file contains HTML attachment with login portal indicators
8d ago
Nov 4th, 2025
Sublime Security
Credential Phishing
Evasion
HTML smuggling
Content analysis
File analysis
Header analysis
HTML analysis
Javascript analysis
Sender analysis
/feeds/core/detection-rules/attachment-eml-file-contains-html-attachment-with-login-portal-indicators-6e4df158
Link: Multistage landing - JotForm abuse
26d ago
Oct 17th, 2025
Sublime Security
Credential Phishing
Evasion
Social engineering
Content analysis
HTML analysis
Javascript analysis
URL analysis
/feeds/core/detection-rules/link-multistage-landing-jotform-abuse-5b64326f
Attachment: HTML with obfuscation and recipient's email in JavaScript strings
1mo ago
Sep 25th, 2025
Sublime Security
Credential Phishing
HTML smuggling
Scripting
Archive analysis
File analysis
HTML analysis
Javascript analysis
/feeds/core/detection-rules/attachment-html-with-obfuscation-and-recipients-email-in-javascript-strings-1aff486b
Attachment: HTML smuggling with eval and atob via calendar invite
1mo ago
Sep 25th, 2025
Sublime Security
Credential Phishing
Malware/Ransomware
Evasion
HTML smuggling
Scripting
File analysis
HTML analysis
Javascript analysis
/feeds/core/detection-rules/attachment-html-smuggling-with-eval-and-atob-via-calendar-invite-597c2edd
Attachment: EML with embedded Javascript in SVG file
3mo ago
Aug 8th, 2025
Sublime Security
Credential Phishing
Malware/Ransomware
Scripting
Evasion
File analysis
Javascript analysis
Sender analysis
/feeds/core/detection-rules/attachment-eml-with-embedded-javascript-in-svg-file-dfafb78f
Attachment: HTML attachment with login portal indicators
3mo ago
Aug 5th, 2025
@ajpc500
Credential Phishing
HTML smuggling
Scripting
Archive analysis
File analysis
HTML analysis
Javascript analysis
Sender analysis
/feeds/core/detection-rules/attachment-html-attachment-with-login-portal-indicators-3aabf4a7
Attachment: HTML attachment with Javascript location
3mo ago
Aug 5th, 2025
@vector_sec
Credential Phishing
Malware/Ransomware
Evasion
HTML smuggling
Scripting
Archive analysis
Content analysis
File analysis
Javascript analysis
HTML analysis
/feeds/core/detection-rules/attachment-html-attachment-with-javascript-location-e0611295
Link: chatbot.page platform abuse
3mo ago
Aug 5th, 2025
Sublime Security
Credential Phishing
Social engineering
Out of band pivot
URL analysis
Natural Language Understanding
Content analysis
HTML analysis
Javascript analysis
URL screenshot
/feeds/core/detection-rules/link-chatbotpage-platform-abuse-bfd6a076
Attachment: HTML smuggling Microsoft sign in
3mo ago
Aug 5th, 2025
Sublime Security
Credential Phishing
Free subdomain host
HTML smuggling
Impersonation: Brand
Social engineering
Archive analysis
Content analysis
File analysis
Header analysis
Javascript analysis
Sender analysis
URL analysis
/feeds/core/detection-rules/attachment-html-smuggling-microsoft-sign-in-878d6385
Attachment: HTML with emoji-to-character map
3mo ago
Aug 5th, 2025
Sublime Security
Credential Phishing
Evasion
HTML smuggling
Impersonation: Brand
Scripting
Social engineering
File analysis
HTML analysis
Javascript analysis
Sender analysis
/feeds/core/detection-rules/attachment-html-with-emoji-to-character-map-3119d086
Attachment: HTML with JavaScript functions for HTTP requests
3mo ago
Aug 5th, 2025
Sublime Security
Credential Phishing
Evasion
Scripting
Content analysis
HTML analysis
Javascript analysis
File analysis
/feeds/core/detection-rules/attachment-html-with-javascript-functions-for-http-requests-01e679fd
Low reputation link to auto-downloaded HTML file with smuggling indicators
3mo ago
Jul 23rd, 2025
Sublime Security
Credential Phishing
Evasion
Free file host
Free subdomain host
HTML smuggling
Impersonation: Brand
Open redirect
Social engineering
Content analysis
File analysis
HTML analysis
Javascript analysis
Sender analysis
URL analysis
/feeds/core/detection-rules/low-reputation-link-to-auto-downloaded-html-file-with-smuggling-indicators-339676c6
Attachment: File execution via Javascript
3mo ago
Jul 16th, 2025
Sublime Security
Malware/Ransomware
Evasion
Scripting
Archive analysis
File analysis
Javascript analysis
Sender analysis
/feeds/core/detection-rules/attachment-file-execution-via-javascript-627ae0b1
Attachment: HTML smuggling with atob and high entropy via calendar invite
5mo ago
Jun 3rd, 2025
Sublime Security
Credential Phishing
Malware/Ransomware
Evasion
HTML smuggling
Scripting
File analysis
HTML analysis
Javascript analysis
Sender analysis
/feeds/core/detection-rules/attachment-html-smuggling-with-atob-and-high-entropy-via-calendar-invite-94d84614
Attachment: HTML smuggling with excessive string concatenation and suspicious patterns
1y ago
Aug 27th, 2024
Sublime Security
Credential Phishing
Evasion
HTML smuggling
Scripting
Social engineering
File analysis
HTML analysis
Javascript analysis
/feeds/core/detection-rules/attachment-html-smuggling-with-excessive-string-concatenation-and-suspicious-patterns-e34fce8d
Attachment: HTML smuggling with unescape
2y ago
Sep 22nd, 2023
Sublime Security
Credential Phishing
Malware/Ransomware
Evasion
HTML smuggling
Scripting
Archive analysis
File analysis
HTML analysis
Javascript analysis
/feeds/core/detection-rules/attachment-html-smuggling-with-unescape-0b0fed36
Attachment: HTML smuggling with excessive line break obfuscation
2y ago
Sep 8th, 2023
Sublime Security
Credential Phishing
Malware/Ransomware
Encryption
Evasion
HTML smuggling
Scripting
Archive analysis
Content analysis
File analysis
HTML analysis
Javascript analysis
/feeds/core/detection-rules/attachment-html-smuggling-with-excessive-line-break-obfuscation-7e901440
Attachment: HTML smuggling with base64 encoded JavaScript function
2y ago
Aug 27th, 2023
Sublime Security
Credential Phishing
Malware/Ransomware
HTML smuggling
Scripting
Archive analysis
Content analysis
File analysis
HTML analysis
Javascript analysis
/feeds/core/detection-rules/attachment-html-smuggling-with-base64-encoded-javascript-function-4e8a12ec
Page 1 of 2