New research has shown that up to half of all HTML attachments sent via email are malicious, which is double the rate of 2022.
“Malicious HTML is still being used by attackers because it works. Getting the right security in place is as important now as it has ever been, if not more so,” researchers from security firm Barracuda Networks advised in a new report.
HTML itself is not capable of executing malicious code on its own, but cyber attackers can use HTML in several ways to carry out attacks that can be harmful.
Cross-site scripting (XSS) attacks
Attackers can inject malicious code into a website’s HTML code, which can then be executed by users who visit the site. This can allow attackers to steal sensitive information like usernames, passwords, and credit card numbers, or to perform actions on behalf of the user (such as transferring money or making purchases).
Phishing attacks
Attackers can use HTML to create convincing replicas of legitimate websites (such as banks or online stores) in order to trick users into entering their login credentials or other sensitive information. This information can then be used for fraudulent purposes.
Malware downloads
Attackers can use HTML to hide links or buttons that, when clicked, download malware onto the user’s computer. This malware can then be used to steal information, spy on the user or even take control of their computer.
Overall, the dangers of HTML-based cyber attacks depend on the specific techniques and tactics used by the attacker, as well as the vulnerabilities of the target system. To protect against these attacks, it’s important to keep software and security systems up-to-date, use strong passwords and multi-factor authentication, and to exercise caution when clicking on links or entering information online.
If your organisation would like advice on how best to protect your business against HTML-based cyber attacks, please contact us.
Author: Lisa Seltzer, Agilient Consultant