Attachment: Gzip-archived with nested HTML file containing image and button link

calendar Sep 3, 2026  ·
Share on: linkedin copy

Flags messages containing a gzip attachment that unpacks to an HTML file (identified via YARA), or messages whose body contains a base64-encoded image alongside an anchor tag styled as a rounded button, where the link's underlying domain resolves to a valid address. This pattern is commonly used to disguise phishing content and evade detection by embedding the malicious link within an image-styled button or compressed HTML payload.

Sublime rule (View on GitHub)

 1name: "Attachment: Gzip-archived with nested HTML file containing image and button link"
 2description: "Flags messages containing a gzip attachment that unpacks to an HTML file (identified via YARA), or messages whose body contains a base64-encoded image alongside an anchor tag styled as a rounded button, where the link's underlying domain resolves to a valid address. This pattern is commonly used to disguise phishing content and evade detection by embedding the malicious link within an image-styled button or compressed HTML payload."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and any(filter(attachments, .file_type == "gz"),
 8          any(file.explode(.),
 9              any(.flavors.yara, . == "html_file")
10              and strings.icontains(.scan.strings.raw, "data:image")
11              and any(html.xpath(strings.parse_html(.scan.strings.raw),
12                                 '//a[.//span[contains(@style,"border-radius")]]/@href'
13                      ).nodes,
14                      strings.parse_url(.raw).domain.valid
15              )
16          )
17  )  
18attack_types:
19  - "Credential Phishing"
20tactics_and_techniques:
21  - "HTML smuggling"
22  - "Image as content"
23  - "Evasion"
24detection_methods:
25  - "Archive analysis"
26  - "YARA"
27  - "HTML analysis"
28  - "URL analysis"
29  - "File analysis"
30id: "c9bd6835-abd4-5430-8a5f-c845e3b5b3f6"
to-top