Email Threats: HTML Smuggling

This ReliaQuest Photon Threat Research briefing explains the HTML smuggling technique, where attackers embed and reconstruct payloads client-side using HTML5 and JavaScript (BLOBs) to deliver malware or credential-phishing pages that can bypass traditional email and network controls; the report includes observed examples, mentions open-source builders, and provides mitigations such as GPOs to open HTML in text editors, user training, perimeter hardening, and monitoring for JavaScript-constructed files.