HTML attachment phishing and HTML smuggling: how they work and how to stop them

Most people think of an HTML file as a web page, not an attachment. That's exactly why attackers use it. An HTML attachment can carry a complete fake sign-in page, a redirect, or the pieces of a malware file that the browser assembles after the email has already passed every scan. This guide explains how these attacks work and how to stop them. For the full list of risky file types, see dangerous email attachment types.

What is HTML attachment phishing?

HTML attachment phishing is any attack where the dangerous part is a web file attached to the email, rather than a link in the message body. The file opens locally in the user's browser.

The common file types:

The lures are familiar: a voicemail, a remittance advice, a shared document, a fax, a delivery notice or an invoice. The attachment is often named to look like something else, such as Remittance_PDF.html or Invoice.pdf.svg.

The three main types of attack

1. Local fake sign-in page. The file itself draws a Microsoft 365 or Google sign-in form, sometimes styled to look like your own company's sign-in page. Whatever the user types is sent to the attacker. There's no suspicious link in the email for a filter to check. See fake Microsoft login pages for how to tell the difference.
2. Redirector. The file contains a little script that sends the browser to a phishing site, often through several hops and a CAPTCHA page.
3. HTML smuggling. The file contains an encoded malware payload. The browser decodes it and saves it to the device.

How does HTML smuggling work?

Microsoft Threat Intelligence described the technique in November 2021 as "a highly evasive malware delivery technique that leverages legitimate HTML5 and JavaScript features." The key point is that the malicious file isn't sent across the network as a file. It's built on the user's device.

In simple terms:

1. The email carries an HTML attachment (or a link to an HTML page).
2. Inside the page, the payload file is stored as encoded text in the JavaScript.
3. When the page opens, the script decodes it into a JavaScript Blob, a block of data in the browser's memory.
4. The script creates a download from that Blob, using the HTML5 download attribute, so the file appears in the user's Downloads folder.
5. The page persuades the user to open the file. In one Trickbot campaign Microsoft described, the user had to type a password shown in the original HTML attachment to open the downloaded file.

MITRE ATT&CK lists the technique as T1027.006 and adds that payloads can also be stored in data URLs or saved with JavaScript functions such as msSaveBlob.

Microsoft's 2021 report linked HTML smuggling to the Mekotio banking trojan, a NOBELIUM spear-phishing campaign in May 2021, remote access trojans such as AsyncRAT and NJRAT, and a Trickbot campaign. These are examples, not a complete list.

Why do spam filters struggle with HTML attachments?

HTML is text, and text is hard to judge on sight.

• Nothing malicious exists yet. With smuggling, the malware doesn't exist until the browser builds it. Microsoft says the technique could "bypass standard perimeter security controls, such as web proxies and email gateways," because those controls look for suspicious attachments and known signatures.
• Obfuscation is cheap. The same page can be encoded differently for every recipient, so signatures and hashes don't match.
• No URL in the body. Link-checking finds nothing, because the address is built by script inside the file or the form posts data from the user's own browser.
• CAPTCHA gates. Many chains put a CAPTCHA in front of the phishing page, which stops automated scanners from seeing the final page.
• Legitimate uses exist. Some systems really do send HTML receipts and reports, so blanket blocking can upset someone.

The scale is real. Microsoft's Q1 2026 email threat report said "HTML attachments started Q1 as the leading file type (37% of payloads in January)." The share swung with campaigns: down 57% in February, nearly tripling in March. One campaign on March 17 sent over 1.5 million messages, each with an HTML attachment that led through staging pages and a CAPTCHA to a fake sign-in page. SVG files rose 49% in February to become the top delivery method for CAPTCHA-gated phishing that month, before falling back in March.

How do you block or quarantine HTML attachments?

The most reliable control is at the gateway: hold HTML-family and SVG attachments before they reach anyone. Quarantine usually beats an outright block, because a handful of genuine HTML files may need releasing.

In Microsoft 365

Use the common attachments filter in an anti-malware policy (Microsoft Learn). At the time of writing (October 2026):

• The default list doesn't include any HTML types.
• The list of additional file types you can select in the Defender portal includes htm, html, mht, mhtml, shtm and xhtml.
• svg and shtml aren't on that list, but you can add your own values.
• The default action is Reject the message with a non-delivery report (NDR); you can choose Quarantine the message instead.
• The filter uses best-effort true type matching, so a renamed file can still be caught. html and mhtml are on the true type list; for types that aren't, it falls back to the extension.

A mail flow rule with the condition Any attachment's file extension matches (AttachmentExtensionMatchesWords) can also catch these extensions. Microsoft notes that this condition doesn't inspect file properties, so a renamed file gets past it. Prefer the anti-malware policy where you can (Microsoft Learn).

In Google Workspace

In the Google Admin console, go to Menu > Apps > Google Workspace > Gmail > Safety, then scroll to Attachments (Google). Two settings matter:

• Protect against attachment with scripts from untrusted senders
• Protect against anomalous attachment types in emails, for file types that are uncommon for your domain

Each defaults to Keep email in inbox and show warning. Change it to Quarantine or Move email to spam if you want the message held.

At a gateway in front of your mailboxes

If mail passes through a filtering service before Microsoft 365, Google Workspace or your own server, add HTML-family extensions and SVG to its attachment-type rules there. The message is held before it reaches any mailbox, and personal quarantine digests let users ask for a release. See what is email quarantine for how releases should work.

A checklist

1. Ask finance, sales and operations whether anyone receives HTML or SVG files by email, and from whom.
2. Quarantine .htm, .html, .shtml, .shtm, .xhtml, .mht, .mhtml and .svg attachments.
3. Make sure archives are opened and these rules applied to the files inside.
4. Quarantine password-protected archives too, because scanners can't see inside them.
5. Agree who can release, and ask regular senders of genuine HTML files to switch to PDF or a link to their portal.
6. Review the quarantine monthly for new file names and lures, and share examples with staff.

What else reduces the risk?

Gateway rules are the first layer. Microsoft's 2021 guidance adds endpoint and browser controls:

• Attack surface reduction rules in Microsoft Defender for Endpoint, including "Block JavaScript or VBScript from launching downloaded executable content."
• Safe Links and Safe Attachments in Microsoft Defender for Office 365, which open attachments in a sandbox before delivery. Microsoft's Q1 2026 report repeats this recommendation.
• File associations. Microsoft suggests you "prevent JavaScript codes from executing automatically by changing file associations for .js and .jse files."
• Phishing-resistant MFA, so a password typed into a local fake sign-in page isn't enough on its own. See adversary-in-the-middle phishing.

MITRE also suggests Content Security Policy rules, browser download policies and watching for files created by the browser shortly after an HTML file is opened. Those are mostly for larger security teams.

What to tell users

• An invoice, voicemail or shared document that arrives as an .html or .svg file is suspicious. Real documents arrive as PDFs, Office files or links to a service you use.
• If opening an attachment shows a sign-in page, close it. Legitimate files don't ask for your password.
• If a web page you opened from email downloaded a file, don't open the file. Report it.
• If you typed a password, follow what to do after clicking a phishing link and tell IT straight away.

Next steps

• Open your anti-malware or attachment policy today and check whether HTML-family and SVG files are quarantined.
• Search your quarantine or message trace for .html and .svg attachments from the last month to see what you'd be holding.
• Check a suspicious message's real origin with the Email Header Analyzer.
• Read stopping phishing emails in Microsoft 365 for the other policies worth turning on.
• iBlockSpam includes attachment-type filters with personal quarantines for every user, so you can hold HTML and SVG files at the MX level. See how it works.

Browse our other phishing and threat guides.