New Wave of SHTML Phishing Attacks

McAfee Labs observed a phishing campaign abusing server-parsed HTML (SHTML) email attachments that use JavaScript to display blurred fake documents and credential-harvesting forms; harvested data is exfiltrated via static form services (Formspree/Formspark) or by redirecting victims to malicious pages. The report contains analysis, code snippets, screenshots, mitigation advice, and IOCs (malicious URLs and SHTML file hashes), and notes that McAfee detections have blocked the identified indicators.