Cybercriminals are increasingly using HTML smuggling to distribute malware. This technique involves using HTML5 attributes to store a binary in JavaScript code, which is decoded into a file object when opened in a web browser. It has become more popular since Microsoft began blocking macros in documents from the internet by default. Trustwave SpiderLabs has identified four malware strains that have been using HTML smuggling in their infection chain: Cobalt Strike, Qakbot, IcedID, and Xworm RAT. This type of attack can be difficult to prevent and protect against, as users often trust HTML files as being safe. To help stop and mitigate HTML smuggling risks, teams in charge of preventing phishing and spam should review their email gateway solution to make sure it can handle these threats. Additionally, security awareness training should be updated to communicate the risks to end users, and an allow list should be created for users who are allowed to send attachments, while stripping attachments out from unknown external sources.
This Cyber News was published on www.csoonline.com. Publication date: Thu, 09 Feb 2023 16:03:02 +0000