Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1027.006sub-technique of T1027 Obfuscated Files or Information

HTML Smuggling

Linux · macOS · Windowsnothing on this site yetT1027.006 on attack.mitre.org

Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML files. HTML documents can store large binary objects known as JavaScript Blobs (immutable data that represents raw bytes) that can later be constructed into file-like objects. Data may also be stored in Data URLs, which enable embedding media type or MIME files inline of HTML documents.

MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Detection Strategy for HTML Smuggling via JavaScript Blob + Dynamic File Drop

  • Detection of browser-based or email client-driven file creation (often from temp directories) following navigation to or execution of HTML files containing JavaScript Blob APIs or base64 Data URLs, with follow-on execution of the dropped payload.
  • Detection of browser-based downloads from HTML sources that trigger file creation in temp or user directories followed by execution of new files within short timeframes and suspicious parent-child lineage.
  • Detection of HTML-based downloads via Safari/Chrome that create obfuscated files (e.g.,.zip,.app,.js) in user directories and are followed by suspicious executions from preview or launch services.

what reduces it

  • M1048 Application Isolation and Sandboxing. Use Browser Extensions or Built-in Security Tools that: - Monitor JavaScript API calls such as `Blob`, `URL.createObjectURL,` and `msSaveOrOpenBlob` - Intercept and analyze HTML5 `download` attributes for suspicious payload generation - Alert or block behaviors that match known HTML smuggling patterns (e.g., blob-to-disk payload construction) Apply Content Security Policy (CSP) headers to: - Restrict inline...

the rest of T1027

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.