Skip to content
fishi

Glossary

HTML smuggling

A trick that hides a harmful file inside an HTML attachment, so it is built on your device when you open it.

HTML smuggling hides a harmful file inside a harmless-looking HTML attachment, often named like an invoice or a voicemail. Opening it in your browser builds the file on your device, so security filters never see it. It may then show a fake login form or download malware. Never open HTML attachments you didn't expect. See also phishing. Fishi inspects HTML attachments for hidden files and login forms: forward the email to check@fishi.email, as an attachment if you can.