HTML smuggling is a malware delivery technique in which an ordinary-looking HTML file or web page carries an encoded payload and uses the browser's own features to rebuild it as a file on the user's device. In plain terms, the email gateway and web proxy only ever see a web page, while the dangerous file is assembled after it has already passed them. Microsoft Threat Intelligence described the technique as "highly evasive" in November 2021, after seeing it in a NOBELIUM spear-phishing campaign and in banking trojan, remote access trojan and Trickbot campaigns. This guide explains what HTML smuggling is, how it works at the level a defender needs, why perimeter controls miss it and which controls and telemetry catch it. It is for email, endpoint and SOC teams and contains no code or attacker procedures.
Key takeaways
- The file is built behind the gateway. The payload travels as encoded data inside HTML or JavaScript and only becomes a file inside the browser, so controls that inspect attachments for file types and signatures see nothing to block.
- It is a delivery step, not a malware family. MITRE ATT&CK tracks it as HTML Smuggling (T1027.006), a sub-technique of Obfuscated Files or Information, and the smuggled file is usually an archive, disk image, script or shortcut that starts the next stage.
- Treat HTML attachments as active content. Microsoft's default common attachments filter does not include htm or html; most organisations can add them, or quarantine them for review, with little business impact.
- The endpoint is where it becomes visible. A browser writing an archive, ISO, script or executable to Downloads moments after an HTML file opens is a strong signal; download origin fields, Mark of the Web and EDR process lineage tell the story.
- Break the second stage. Attack surface reduction (ASR) rules for scripts and untrusted executables, script file re-association, application control and SmartScreen stop what the smuggled file tries to do next.
What it is
A normal download works like this: the browser asks a server for a file and the server sends it. Gateways and proxies sit in that path and can inspect the file. HTML smuggling removes the file from the path. The HTML page contains the file's bytes in encoded form, and when the page opens, script in the page decodes them and hands them to the browser as a download that appears to come from the page itself.
MITRE ATT&CK describes three browser features involved, all of them legitimate and widely used:
- JavaScript Blobs: objects that hold raw bytes in memory and can be turned into file-like objects.
- Data URLs: a way to embed a file's content inline in a page rather than linking to it.
- The HTML5 download attribute: tells the browser to save the target of a link as a file with a given name instead of opening it.
ATT&CK notes that the content may be carried under ordinary MIME types such as text/plain and text/html, which is why web content filters may not recognise it. A close relative, SVG Smuggling (T1027.017), hides the same kind of script inside an SVG image file, and ATT&CK notes the two can be combined.
The technique arrives in two ways, according to Microsoft: as an HTML attachment to an email, or as a link in an email to a web page that performs the smuggling. Both map to Phishing (T1566), and the user opening the resulting file is User Execution: Malicious File (T1204.002). See the Phishing Guide for the wider delivery picture.
How it works
The chain below is described from the defender's side: what each stage looks like and which control can break it.
| Stage | What the defender sees | ATT&CK | Control that breaks it |
|---|---|---|---|
| Delivery | An email with an .htm or .html attachment, or a link to a page, often themed as an invoice, voicemail, report or secure message | T1566.001, T1566.002 | Common attachments filter with htm/html added, Safe Attachments detonation, Safe Links time-of-click checks |
| Assembly in the browser | The browser opens a local or remote page; encoded data is decoded in memory, sometimes after checks on the device or user-agent | T1027.006 | Detonation that runs script, browser isolation, network protection for known bad domains |
| Download | The browser writes a file, commonly an archive, ISO or IMG disk image, script file or shortcut, to the Downloads folder | T1027.006, T1204.002 | SmartScreen reputation checks, EDR file creation alerts, blocking risky file types at the endpoint |
| Execution | The user opens the file; a script host, shortcut or executable starts and fetches or launches the next stage | T1204.002, T1553.005 | ASR rules, script re-association to Notepad, application control |
What real campaigns smuggled
Microsoft's two primary write-ups show the range of payloads and why the second stage matters as much as the first:
- NOBELIUM (May 2021): Microsoft named the HTML dropper EnvyScout. It decoded an ISO disk image hidden in the page and saved it to disk; mounting the image showed a shortcut that launched a downloader. Some variants checked the environment first, for example redirecting iOS visitors elsewhere, which also frustrates sandboxes. Microsoft noted that the files inside the ISO lacked Mark of the Web propagation, weakening host-based protections. See the ISO and Container File Malware Delivery Guide and the Malicious LNK Files Guide.
- Banking trojans (2021): in one Mekotio campaign a phishing link led to a page that dropped a ZIP containing obfuscated JavaScript, which fetched a second archive and loaded a malicious DLL alongside a legitimate program for credential theft and keylogging.
- Trickbot (September 2021): an HTML attachment disguised as a business report built a password-protected JavaScript file in the Downloads folder. Microsoft noted the operator works with ransomware groups, so a compromise often leads to ransomware.
The pattern across all three is the same: smuggling gets a file past the gateway, then a container, script or shortcut does the real work. See the Malware Loaders and Droppers Guide for what typically follows.
Why it matters
Microsoft explains the gap simply: perimeter controls such as web proxies and email gateways often look for suspicious attachment types or match signatures, but with smuggling the malicious file is only created after the HTML loads, so the tools may see only benign, possibly obfuscated, HTML and JavaScript. Turning off JavaScript would stop Blob-based smuggling, but business web applications depend on it. No single layer is enough.
Controls, layer by layer
| Layer | Control (feature names as documented) | What it does against smuggling | Trade-off |
|---|---|---|---|
| Email: file type | Anti-malware policy common attachments filter, adding htm and html; action Reject with NDR or Quarantine | Stops HTML attachments arriving at all. Microsoft's default list includes hta, iso, img and lnk but not htm or html, so this is a deliberate change | Some business mail (e-receipts, system notifications) uses HTML attachments; quarantine with an exception process is a gentler start |
| Email: detonation | Safe Attachments policy, action Block or Dynamic Delivery; Safe Links | Opens attachments in a virtual environment and checks links at click time, which can catch the assembled payload | Environment checks in the page can defeat sandboxes; scanning can delay delivery |
| Email: after delivery | Zero-hour auto purge (ZAP) | Removes messages later identified as malicious | Only helps once a verdict exists |
| Content disarm and reconstruction | Gateway CDR that strips active content from HTML or rebuilds attachments | Removes script, so the embedded payload never assembles | Can break legitimate interactive HTML; coverage varies by product |
| Browser and download | Microsoft Defender SmartScreen; network protection | Reputation checks on downloaded files, apps, signing certificates and URLs; blocks known malicious domains for remote pages | New, unseen payloads have no reputation, so SmartScreen warns rather than blocks unless bypass is prevented |
| Endpoint: second stage | ASR rules, script re-association, application control | Stops the smuggled script or executable running or launching downloaded content | Needs audit time and tuning, covered below |
Microsoft's 2021 guidance lists three ASR rules as directly relevant. The names and GUIDs below are as given in Microsoft's ASR rules reference:
| ASR rule | GUID | Dependency |
|---|---|---|
| Block JavaScript or VBScript from launching downloaded executable content | d3e037e1-3eb8-44c8-a917-57927947596d | Defender Antivirus, AMSI |
| Block execution of potentially obfuscated scripts | 5beb7efe-fd9a-4556-801d-275e5ffc04cc | Defender Antivirus, AMSI, cloud protection |
| Block executable files from running unless they meet a prevalence, age, or trusted list criterion | 01443614-cd74-433a-b99e-2ecdc07bfc25 | Defender Antivirus, cloud protection |
| Block executable content from email client and webmail | be9ba2d9-53ea-4cdc-84e5-9b1eeee46550 | Defender Antivirus |
Microsoft also recommends changing the file association for .js and .jse files through Group Policy so they open in Notepad rather than running. See the Windows Endpoint Hardening Guide and the Application Allowlisting Guide.
Rolling it out
- Measure first: report a month of inbound HTML attachments by sender.
- Quarantine before rejecting: add htm and html to the common attachments filter with the Quarantine action for a pilot group, review releases, then extend to everyone. Keep a short, owned allow list for known senders.
- Pilot ASR rules in Audit: deploy the script and executable rules above in Audit mode to a pilot ring, review audit events for two to four weeks, add narrow exclusions, then move to Block.
- Re-associate script types: push the Notepad association for .js and .jse, test with the software inventory, then widen.
- Prevent warning bypass: once SmartScreen false positives are understood, stop users overriding file warnings on managed devices.
- Roll back narrowly: if a process breaks, release a sender or move one rule back to Audit; do not remove HTML from the filter tenant-wide.
Small vs large organisations: a small organisation using one mail platform can usually block HTML attachments outright and enable the ASR rules in Block after a short audit. A large organisation with many automated senders will need quarantine with an exception register, detonation for permitted senders and SOC detections, because some HTML mail will always be allowed.
Common misconceptions
- "Our gateway scans attachments, so we are covered": the gateway scans what is attached, and the attachment is HTML. Unless it runs the script in a sandbox, it never sees the assembled file.
- "Blocking the file types we fear is enough": blocking ISO, LNK and executables at the gateway does not stop the same files being created by a browser on the endpoint. Endpoint controls on those file types matter as much as email rules.
- "Downloads always carry Mark of the Web": Microsoft states that Mark of the Web is added for files from the Internet or Restricted sites zones and only on NTFS volumes. NOBELIUM's ISO contents lacked it once mounted. Treat MOTW as a useful signal, not a guarantee, and see Mark-of-the-Web Bypass (T1553.005).
- "Sandbox detonation will always catch it": EnvyScout variants checked the environment and user-agent before writing the payload, a pattern designed to stay quiet in analysis environments.
Related concepts
Detection and measurement
- Download origin telemetry: in Microsoft Defender advanced hunting, the DeviceFileEvents table records FileOriginUrl, FileOriginReferrerUrl and FileOriginIP for downloaded files. Because a smuggled file is generated by the page rather than fetched from a server, its recorded origin often does not look like an ordinary download from a web server. How these fields are populated for script-generated downloads is not documented on that page and varies by browser, so generate a harmless script-built test download in each managed browser, record what the fields show, and build the custom detection from that baseline.
- Mark of the Web: Windows stores the zone in an alternate data stream named Zone.Identifier, with ZoneId 3 for Internet. Hunting for archives, disk images and scripts in Downloads created by a browser within seconds of an HTML file opening, with or without MOTW, finds most cases.
- Process lineage: alert on a browser or archive tool leading to wscript, cscript, mshta or a newly written executable, and on disk image mounts followed by a shortcut launch. Microsoft's NOBELIUM write-up lists the alert "A link file (LNK) with unusual characteristics was opened" as a lower-confidence lead worth investigating.
- ASR events: advanced hunting ActionType values AsrScriptExecutableDownloadBlocked, AsrObfuscatedScriptBlocked and AsrUntrustedExecutableBlocked (and the Audited forms during pilots). See the Endpoint Telemetry Guide and the EDR Guide.
Metrics that show it is working: HTML attachments delivered to inboxes per month (trend to near zero outside the allow list); percentage of devices with the three script and executable ASR rules in Block; median time from a browser-written archive or script alert to triage; number of smuggling-pattern detections confirmed by the SOC versus found later in incidents; SmartScreen file warnings overridden by users per month; allow-listed HTML senders, each with an owner and review date.
Framework mapping
| Framework | Reference | How it applies |
|---|---|---|
| MITRE ATT&CK | T1027.006, T1027.017, T1566.001, T1204.002, T1553.005 | The smuggling step, its SVG variant, delivery, user execution and MOTW evasion |
| ATT&CK mitigations | M1021 Restrict Web-Based Content, M1031 Network Intrusion Prevention, M1038 Execution Prevention, M1042 Disable or Remove Feature or Program | Filter HTML and script content, block execution of dropped files, remove script handlers |
| NIST CSF 2.0 | PR.PS-05, DE.CM-01, DE.CM-09 | Prevent unauthorised software execution; monitor networks and endpoints for adverse events |
| NIST SP 800-53 Rev. 5 | SI-3, SI-4, SI-8, SC-18 | Malicious code protection, system monitoring, spam protection, mobile code (script) controls |
| CIS Controls v8.1 | Control 9, Control 10 | Email and web browser protections; malware defences |
| ISO/IEC 27001:2022 | A.8.7, A.8.23 | Protection against malware; web filtering |
Neighbouring techniques
HTTP request smuggling shares only the name: it is a web server desynchronisation flaw, covered in the HTTP Request Smuggling Guide. Browser isolation keeps page script away from the endpoint entirely; see the Remote Browser Isolation Guide. For the wider family map see the Malware Guide.
Practitioner checklist
- Add htm and html to the email common attachments filter, starting with Quarantine for a pilot and an owned sender allow list.
- Enable Safe Attachments (Block or Dynamic Delivery), Safe Links and ZAP, or the equivalent detonation and time-of-click checks on your mail platform.
- Deploy the four ASR rules for scripts, obfuscated scripts, untrusted executables and email executable content in Audit, then Block.
- Re-associate .js and .jse, and other script types users do not need, to Notepad by Group Policy or Intune.
- Enable SmartScreen and network protection, and prevent users bypassing file warnings on managed devices.
- Build a custom detection for browser-written archives, disk images and scripts whose origin is not an ordinary web URL.
- Alert on disk image mounts followed by shortcut or script execution from the mounted drive.
- Include HTML attachment lures in awareness training and give users a one-click way to report them.
Standards and references
- MITRE ATT&CK: HTML Smuggling (T1027.006)
- Microsoft Security Blog: HTML smuggling surges, highly evasive loader technique increasingly used in banking malware and targeted attacks
- Microsoft Security Blog: Breaking down NOBELIUM's latest early-stage toolset
- Microsoft Learn: Attack surface reduction rules reference
- Microsoft Learn: Anti-malware protection in EOP
- Microsoft Learn: DeviceFileEvents table in advanced hunting
- Microsoft Learn: Microsoft Defender SmartScreen
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Malware Guide · Email Security Guide · ISO and Container File Malware Delivery Guide · Malicious LNK Files Guide · Macro Malware Guide