Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This past month, Trustwave SpiderLabs observed that HTML (Hypertext Markup Language) file attachments had become a common occurrence in our spam traps, which is not unusual since malware is often delivered through phishing spam.

The threat involves the use of HTML file attachments as a vector for malware delivery, primarily through phishing campaigns. Trustwave SpiderLabs has observed a resurgence of HTML attachments in spam traps, indicating attackers continue to exploit this method. These HTML files often contain obfuscated JavaScript code that executes when the user opens the attachment, leveraging techniques such as HTML smuggling to bypass traditional email security filters. The malware families associated with this threat include TrickBot and QakBot, both notorious for their modular capabilities, persistence, and data theft. The attack chain typically involves a phishing email with an HTML attachment that, when opened, silently downloads and executes malicious JavaScript from URLs hosted on suspicious domains (e.g., valdia.quatiappcn.pw and fatnaoacnsoxzssa.web.app). These scripts can then deploy payloads that perform credential theft, lateral movement (T1055 - Process Injection), and user execution exploitation (T1204). The threat leverages social engineering (T1566) to trick users into opening the attachments, and the obfuscation techniques make detection challenging. Although no known exploits in the wild are reported for zero-day vulnerabilities, the widespread use of this technique and the involvement of advanced malware families make it a persistent medium-severity threat. The indicators include multiple URLs hosting malicious JavaScript and hashes of malicious files, useful for detection and blocking.

Detailed information about HTML File Attachments: Still A Threat. Get real-time updates, technical details, and mitigation strategies.

HTML File Attachments: Still A Threat - Live Threat Intelligence - Threat Radar | OffSeq.com

HTML File Attachments: Still A Threat

Threats Tagged 'html attachments'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'html attachments'

Lead Pen Test Professional