Web and email filters inspect files as they pass through. HTML smuggling avoids that by sending no file at all. The page carries a pile of encoded data and a few lines of JavaScript, and the browser builds the file on the victim's own machine.
MITRE tracks this as HTML Smuggling, technique T1027.006, a sub-technique of Obfuscated Files or Information in the Stealth tactic. It applies to Linux, macOS and Windows.
How attackers use it
HTML documents can hold large binary objects called JavaScript Blobs, which are immutable data representing raw bytes that can later be turned into file-like objects. Data can also be stored in Data URLs, which embed a media type or MIME file inline. HTML5 added a download attribute that can start a file download.
An adversary combines those features. The page arrives with benign MIME types such as text/plain or text/html, so web content filters may see nothing wrong. The hidden file is then rebuilt, which is the Deobfuscate/Decode step, when it reaches the victim. MITRE gives the example of Blobs being used to create a malicious file on the victim machine, and dropped to disk through functions such as msSaveBlob.
The key idea: the dangerous file never crossed the network as a file. Proxy logs may show a small HTML page and no download of the payload.
How to detect it
MITRE's strategy (DET0313) covers three platform families.
- Windows. A browser or email client creating a file, often in a temp directory, after a user opens an HTML file that contains JavaScript Blob APIs or base64 Data URLs, followed by execution of the dropped payload. MITRE suggests using Sysmon event ID 15 to inspect the Zone.Identifier alternate data stream for HostUrl or ReferrerUrl values such as about:internet. It also points to a useful negative signal: no matching large HTTP download in the proxy logs for the same URL and client, which suggests the file was built locally.
- Linux. Downloads from HTML sources that create files in temp or user directories, then execution of the new files in a short time with suspicious parent and child process lineage.
- macOS. Safari or Chrome downloads from HTML sources creating obfuscated files such as .zip, .app or .js in user directories, followed by suspicious execution from preview or launch services.
A short chain is the signature: user opens an HTML file, browser writes a new file, new file runs.
How to reduce the risk
MITRE lists application isolation and sandboxing, and its guidance is specific:
- Use browser extensions or built-in security tools that monitor JavaScript API calls such as Blob, URL.createObjectURL and msSaveOrOpenBlob, and that inspect HTML5 download attributes. They should alert or block behaviors that match known smuggling patterns, such as a blob being written out as a payload.
- Apply Content Security Policy (CSP) headers to restrict inline JavaScript and dynamic script generation, disallow downloads from unauthorized sources or blob URIs, and prevent cross-origin resource sharing abuse that smuggling chains use.
- Enable enterprise browser and endpoint controls. That includes Network Protection and Attack Surface Reduction rules, which can block Office and browser processes from creating child processes or writing to disk in suspicious ways, and Chrome Enterprise policies that control download behavior and restrict extensions.
- Deploy browser sandboxing that isolates JavaScript execution and enforces behavioral policy.
Check your own environment
# Windows: which Attack Surface Reduction rules are set, and in which mode?
Get-MpPreference | Select-Object AttackSurfaceReductionRules_Ids, AttackSurfaceReductionRules_Actions
Then check:
- Does your email gateway treat HTML attachments as risky, or let them through like text files?
- Do you collect Sysmon event ID 15, or an equivalent, so you can see where a downloaded file came from?
- Can your proxy tell you that a user opened an HTML page and then no matching file download was seen?
- Are Chrome Enterprise or similar browser policies applied to managed devices?
- If you publish web applications, do your own pages send a Content Security Policy header?
Quick check
Why can proxy logs miss HTML smuggling?
The payload is built inside the browser from encoded data in the page. The network sees an HTML or text file, not the malicious file itself.
What negative signal does MITRE mention?
A file created in the user area with no matching large HTTP download for the same URL and client in proxy logs. That suggests the file was assembled locally.
Name two browser side controls MITRE lists.
Monitoring or blocking Blob and download attribute behaviors, Content Security Policy headers, enterprise browser policies, ASR rules and Network Protection, or browser sandboxing. Any two.
Sources
- MITRE ATT&CK, HTML Smuggling (T1027.006)
