The Attachment That Builds Its Own Phishing Link at Runtime

The attachment scanner marked it clean. A 24 KB HTML file, no macros, no embedded links, no credential form. On paper, nothing to flag.

That verdict was correct and completely wrong at the same time. The file contained no malicious link because it built one after the recipient opened it. A few lines of JavaScript assembled a credential harvesting URL at runtime, stitched together from a randomly generated subdomain, a nonstandard port, and the target's own email address. Static analysis had nothing to catch, because the payload did not exist yet.

The target was an accounts receivable specialist at a global maritime shipping company. The lure was a fake domain renewal notice with a subject engineered for urgency: a warning that registration required renewal to avoid service interruption. The attachment was skinned to look like a Microsoft 365 admin console message. Every piece was built to get one file opened, once.

What the Scanner Saw, and What It Didn't

The attachment arrived as an HTM file, roughly 23.8 KB, disguised with a filename that mimicked an admin center notification. The gateway scanned it and returned a verdict of clean. There was no false negative in the traditional sense. The static file genuinely held no forms, no visible links, and no obvious script signatures matching a known kit.

This is the trap. Static attachment analysis answers one question: does this file, as it sits on disk, contain something malicious? For this file, the honest answer was no. The malice was not in the bytes. It was in what those bytes would do a few milliseconds after a browser rendered them.

Credential phishing has been drifting toward attachments for exactly this reason. When the malicious destination lives inside a file rather than a link in the body, URL reputation checks at the gateway never get a URL to check.

The URL That Assembled Itself at Click Time

Open the file and a short inline script runs. It does three things in sequence.

First, it generates a random subdomain string. Second, it prepends that string to the attacker domain hcf-fr[.]com, appends the nonstandard port 8443, and adds a path. Third, it splices the recipient email address into the query string. The finished endpoint looked like this:

hxxps://{random-subdomain}.hcf-fr[.]com:8443/impact?[token]=[recipient-email]

The script then loaded that endpoint into an embedded frame, pulling the real credential collection page down from the remote server at runtime. The login form the victim would eventually see never touched their inbox. It lived on the attacker infrastructure and arrived only on demand.

Each component is a deliberate evasion choice:

• The randomized subdomain means every victim gets a unique host. Blocklists that work on exact matches lag behind, and takedowns hit a moving target.
• Port 8443 carries HTTPS outside the default 443. Proxies and filters that only inspect standard web ports can wave it through.
• The spliced recipient email turns the landing page into a targeted, prefilled experience. It also doubles as a tracking beacon confirming the address is live and the file was opened.

This maps cleanly to MITRE ATT&CK T1566.001, Spearphishing Attachment, with the runtime assembly behaving like T1027, Obfuscated Files or Information, and the reliance on the victim opening the file falling under T1204.002, User Execution: Malicious File. The obfuscation here is not encoded strings. It is the absence of the payload entirely until execution.

See Your Risk: Calculate how many threats your SEG is missing

The Authentication Laundry

The sender story is just as instructive. The message claimed to come from Mason.McWherter@haoranchalerkotha[.]com. The original connecting host, IP 31[.]58[.]144[.]13, produced an SPF softfail against that domain, DKIM was absent, and DMARC failed outright.

By the time the message reached the target, none of that failure was obvious at the edge. The mail had been relayed through Microsoft 365 protection infrastructure, routed through an onmicrosoft.com tenant that re-signed it with a valid DKIM signature and produced an SPF pass on the relay hop. Composite authentication came back as a pass. The From domain still failed DMARC, but the surface signals looked healthy.

This is reputation laundering. Route external mail through a trusted gateway and the trusted gateway's own passing checks paper over the origin's failures. Anyone triaging on SPF or DKIM pass alone would see green where there should have been a stop sign. It is why authentication results are evidence, not a verdict.

Where Themis Broke the Chain

The gateway called the attachment clean. Themis, the IRONSCALES agentic AI SOC analyst, did not agree with the conclusion that followed. Its Adaptive AI weighed the message across three axes at once: content signals in the urgent renewal subject, sender signals in the mismatched domain and first-time sender behavior, and community signals correlating the message against how similar reports had resolved across the customer base. It landed at 89% phishing confidence and quarantined the message.

The difference in outcome came down to the difference in question. The scanner asked whether the file was malicious. Themis asked whether the message was, and a behavioral and community lens does not depend on a payload sitting still long enough to fingerprint. This is the core of credential harvesting protection: catch the intent, not just the artifact.

Why Runtime Assembly Beats Static Scanning

Attachment-borne phishing is not a niche. The 2024 Verizon Data Breach Investigations Report found phishing present in 15% of breaches, and stolen credentials involved in 38%. Stolen credentials are the product this attack was built to manufacture, and they are expensive. IBM's Cost of a Data Breach report consistently ranks stolen or compromised credentials among the costliest and slowest breach root causes to contain.

The Microsoft Digital Defense Report 2024 documents the same shift toward evasion by construction rather than by obvious malicious content. When the malicious element is assembled on the endpoint, defenses that inspect only what crosses the wire are looking in the wrong place. Advanced malware and URL protection has to reason about behavior, not just contents.

What to Actually Do

Treat HTML and HTM attachments as executable content, because that is what they are. Detonate them in a sandbox and observe what they load, rather than trusting a static verdict. Do not let a clean file scan close an investigation on its own.

Watch for outbound connections to nonstandard ports like 8443 and for rapidly rotating subdomains under a single registered domain. Both are runtime tells that a static scan will never surface. And stop treating an SPF or DKIM pass on a relay hop as proof of trust. The CISA phishing guidance is blunt on this point: layered, behavior-aware defenses beat any single authentication or signature check.

Indicators of Compromise

The Bottom Line

A clean scan is an answer to a narrow question. This attachment proved how narrow. The moment a file can assemble its own destination after it opens, the only defense that holds is one that judges behavior and intent, not the bytes at rest.