Attachment: HTML smuggling with RC4 decryption

calendar Jan 12, 2026  ยท
Share on: linkedin copy

Potential HTML smuggling. The RC4 algorithm is used within inline JavaScript to decrypt the payload on-the-fly.

Sublime rule (View on GitHub)

 1name: "Attachment: HTML smuggling with RC4 decryption"
 2description: |
 3  Potential HTML smuggling.
 4  The RC4 algorithm is used within inline JavaScript to decrypt the payload on-the-fly.  
 5references:
 6  - "https://delivr.to/payloads?id=0dcec496-0130-465c-bf3d-c9714e17d4d4"
 7  - "https://playground.sublimesecurity.com?id=6b219754-2b0b-47c3-ba53-ec080d946499"
 8type: "rule"
 9severity: "high"
10source: |
11  type.inbound
12  and any(attachments,
13          (
14            .file_extension in~ ("html", "htm", "shtml", "dhtml")
15            or .file_extension in~ $file_extensions_common_archives
16            or .file_type == "html"
17          )
18          and any(file.explode(.),
19                  any(.scan.strings.strings,
20                      strings.ilike(., "*?[(?[?]+?[?])%256]*")
21                  )
22          )
23  )  
24attack_types:
25  - "Credential Phishing"
26  - "Malware/Ransomware"
27tactics_and_techniques:
28  - "Encryption"
29  - "Evasion"
30  - "HTML smuggling"
31  - "Scripting"
32detection_methods:
33  - "Archive analysis"
34  - "Content analysis"
35  - "File analysis"
36  - "HTML analysis"
37  - "Javascript analysis"
38id: "3a46d765-4b27-5026-9b8e-043e3817854b"
to-top