Attachment: HTML smuggling with dynamically constructed redirect URL

calendar Sep 29, 2026  ·
Share on: linkedin copy

Detects HTML attachments, including those nested inside forwarded EML files, that contain obfuscated JavaScript designed to dynamically assemble a redirect URL at runtime rather than embedding it directly in the markup. The script typically builds an empty route via route.join, sets an image or iframe src from a url/protocol variable, and defines a host string separately, a pattern used to evade static URL scanning before sending the recipient to a credential phishing page.

Sublime rule (View on GitHub)

 1name: "Attachment: HTML smuggling with dynamically constructed redirect URL"
 2description: "Detects HTML attachments, including those nested inside forwarded EML files, that contain obfuscated JavaScript designed to dynamically assemble a redirect URL at runtime rather than embedding it directly in the markup. The script typically builds an empty route via route.join, sets an image or iframe src from a url/protocol variable, and defines a host string separately, a pattern used to evade static URL scanning before sending the recipient to a credential phishing page."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(attachments,
 8          (
 9            .file_type == "html"
10            and 2 of (
11              regex.icontains(file.parse_html(.).raw,
12                              'route\.join\(\s*["'']{2}\s*\)'
13              ),
14              regex.icontains(file.parse_html(.).raw,
15                              '\.src\s*=\s*(?:url|protocol)'
16              ),
17              regex.icontains(file.parse_html(.).raw, 'const\s+host\s*=\s*["'']')
18            )
19          )
20          or (
21            (.file_extension == "eml" or .content_type == "message/rfc822")
22            and any(file.parse_eml(.).attachments,
23                    .file_type == "html"
24                    and 2 of (
25                      regex.icontains(file.parse_html(.).raw,
26                                      'route\.join\(\s*["'']{2}\s*\)'
27                      ),
28                      regex.icontains(file.parse_html(.).raw,
29                                      '\.src\s*=\s*(?:url|protocol)'
30                      ),
31                      regex.icontains(file.parse_html(.).raw,
32                                      'const\s+host\s*=\s*["'']'
33                      )
34                    )
35            )
36          )
37  )  
38attack_types:
39  - "Credential Phishing"
40tactics_and_techniques:
41  - "HTML smuggling"
42  - "Evasion"
43  - "Impersonation: Brand"
44  - "Social engineering"
45  - "Scripting"
46detection_methods:
47  - "HTML analysis"
48  - "Javascript analysis"
49  - "File analysis"
50id: "78cda2f4-d648-5919-b83d-62f48ba7e1cc"
to-top