The Employee Handbook That Built Its Own Links at Runtime

The HTML attachment contained zero forms. Zero external URLs. Zero embedded links of any kind. Static analysis scored it LOW risk, because from a markup perspective there was nothing malicious to find.

That was the point.

The phishing links did not exist until the file was opened in a browser. Inline JavaScript assembled them character by character at runtime, pulling a base64-encoded recipient token from a variable declaration to personalize the attack. The file had no malicious content until it had a victim.

A Handbook Nobody Wrote

The email arrived from Advocacy@cdr-ct[.]org, a nonprofit advocacy domain sending to a cybersecurity vendor for the first time. SPF and DKIM passed for the sender domain. The subject line referenced the target organization's brand, giving the message the appearance of an internal HR communication arriving through external infrastructure.

The body was a single image. No selectable text anywhere. The image displayed an "EMPLOYEE HANDBOOK" banner with a "Reminder Acknowledgement request terms form" call to action. Because the entire message was rendered as a graphic, text-based analysis engines (keyword matching, NLP, sentiment detection) had nothing to process. The lure existed only as pixels.

The attachment filename mimicked an internal document: a 2025 handbook reference with an alphanumeric tracking code appended. An additional .eml attachment was also present but could not be analyzed by the scanning infrastructure, producing a FileNotFoundError during automated inspection.

JavaScript That Builds Itself

Inside the HTML file, a variable declaration stored the obfuscated recipient token: a base64 string wrapped in delimiter characters. Decoded, the token resolved to the target's email address. A String.fromCharCode sequence then assembled the credential harvesting URL character by character, concatenated the decoded email as a parameter, and rendered the result as a clickable element in the DOM.

No eval() call appeared in the source. The script relied on standard DOM manipulation to inject the link, which is why automated sandbox evasion scoring flagged it as MEDIUM for obfuscated script rather than HIGH. Without eval(), without document.write(), without any of the typical red-flag functions, the JavaScript fell below the heuristic threshold that triggers dynamic execution in most scanning environments.

This is the detection gap that runtime link construction exploits. Static scanners see clean markup. Dynamic scanners need to actually execute the JavaScript and inspect the resulting DOM, a step many email security pipelines skip for HTML attachments because of performance and resource constraints.

See Your Risk: Calculate how many threats your SEG is missing

Indicators of Compromise

MITRE ATT&CK Mapping