HTML Phishing Attachment Uses "Comment Stuffing" to Evade AI-Based Detection (SharePoint/Teams Credential Harvesting via Formspark)

HTML Phishing Attachment Uses "Comment Stuffing" to Evade (TL-2026-1168), also tracked as Comment Stuffing Phishing, is a medium-severity phishing campaign, first published 2026-07-10. It has no confirmed attribution, affects Generic Email/Attachment Security Gateways (AI/NLP-based content, maps to 16 MITRE ATT&CK techniques (T1027, T1027.006, T1056.003), and is covered by 9 detection rules and 17 indicators of compromise.

Key facts for TL-2026-1168

Threat ID
TL-2026-1168
Also known as
Comment Stuffing Phishing, AI-Evasion HTML Padding Phishing
Severity
MEDIUM
Status
ACTIVE
Category
PHISHING
First published
2026-07-10
Last reviewed
2026-07-10
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
all sectors generic credential-phishing lure, enterprise m365 users
Target regions
Global
Detection rules
9
Indicators of compromise
17

Malware and tooling in HTML Phishing Attachment Uses "Comment Stuffing" to Evade

Malware and tooling: Formspark

SANS ISC handler Jan Kopriva identified a phishing campaign delivering an oversized (2,589 kB) HTML attachment spoofing Microsoft Teams/SharePoint "Pending Approvals" notifications. Roughly 420 kB of the file's ~430,000 repeated "X" characters are Unicode-escaped and hidden inside a single HTML comment after the closing </html> tag, apparently to dilute the malicious-content ratio and overwhelm AI/NLP-based scanners. The functional ~11 kB phishing payload renders a fake SharePoint login and exfiltrates harvested credentials via the legitimate Formspark form-handling service.

How HTML Phishing Attachment Uses "Comment Stuffing" to Evade works

On 2026-07-10, SANS Internet Storm Center handler Jan Kopriva published an analysis of a phishing email observed carrying an unusually large (2,589 kB) HTML attachment named in the pattern "<company_name>_Pending_Approvals#<digits>.xls.html", designed to impersonate a Microsoft Teams/SharePoint pending-approval notification. Examination of the email headers showed multiple spoofing and infrastructure red flags: the display name claimed to be "Microsoft Teams Notifications" while the envelope/reverse-path sender was null (MAIL FROM:<>), no Date header was present (rendering as "None" in Outlook), the X-Priority header was set to an out-of-range value of 0, no DKIM signature was present, and SPF/DMARC evaluation failed. The email was sent from IP 35.195.254.112, hosted on Google Cloud, with an SPF record fallback referencing the RFC 1918 (non-routable) address postmaster@[10.88.0.3] — behavior consistent with a homemade mailer script talking directly to a mail transfer agent rather than a commercial ESP or standard MTA software.

Of the 2,589 kB HTML attachment, only about 11 kB constitutes the actual functional phishing page; roughly 420 kB (~97% of the file) is a single HTML comment placed after the closing </html> tag, containing approximately 430,000 repetitions of the letter "X", each individually encoded as a Unicode escape sequence (\u0058) and reconstituted at render time via JavaScript's unescape() and document.write() functions. Because the padding sits inside an HTML comment and is never rendered, it is invisible to a human victim opening the attachment, but it dramatically alters the statistical/textual profile of the file as seen by static content scanners, heuristic classifiers, and LLM/NLP-based triage tools — the technique is designed either to dilute the ratio of malicious signal to total content, or to exceed the token/processing budget of automated AI-assisted detection pipelines, causing the file to be truncated, misclassified, or skipped.

Once opened, the visible portion of the HTML file renders a spoofed SharePoint credential-entry page. The page dynamically fetches the target organization's logo via the Clearbit Logo API (a now-defunct free logo-lookup service as of end-2025) to add a veneer of legitimacy, and includes basic anti-analysis JavaScript that attempts to intercept/block browser developer tools and the View Source (Ctrl+U) keyboard shortcut to hinder manual inspection. Submitted credentials are POSTed to the Formspark form-backend-as-a-service platform rather than to attacker-controlled infrastructure, a technique that has become common across HTML-attachment phishing campaigns (also observed abusing Formspree, EmailJS, formbold, and submit-form.com) precisely because it decouples credential exfiltration from the phishing page's own hosting, is difficult to block without impacting legitimate Formspark customers, and lets attackers rotate phishing page hosting freely while the collection endpoint persists.

This "comment stuffing" technique is a direct evolution of a related obfuscation approach the same SANS ISC handler documented on 2025-11-21: "CSS stuffing," in which a 449 kB credential-harvesting page (hosted on Google Firebase Storage) contained only ~10 kB of functional code, with the rest padded by renamed/modified copies of legitimate CSS and a duplicated bootstrap.min.css, additionally using the <html lang="zxx"> attribute (ISO 639-2 code for "no linguistic content") as a further evasion signal. Both techniques represent a broader trend of threat actors engineering phishing kits specifically to defeat AI/ML-based email and attachment security products, rather than only signature- or human-analyst-based defenses — an emerging counter-detection category security teams should track independent of any single campaign.

No CVE or software vulnerability is associated with this threat; it is a social-engineering/detection-evasion technique rather than an exploit. Severity is assessed as MEDIUM: the credential-harvesting outcome is a common and well-understood impact, but the novel AI-evasion padding technique and abuse of a legitimate SaaS exfiltration channel (Formspark) warrant tracking and detection-rule updates (e.g., flagging oversized HTML attachments with anomalously high ratio of comment/whitespace content, Unicode-escape-heavy JavaScript, and outbound POSTs to known form-backend-as-a-service domains).

MITRE ATT&CK techniques used in TL-2026-1168

Defense Evasion

T1027 Obfuscated Files or Information; T1027.006 HTML Smuggling; T1497 Virtualization/Sandbox Evasion

Credential Access

T1056.003 Web Portal Capture; T1539 Steal Web Session Cookie

Collection

T1119 Automated Collection

Initial Access

T1566 Phishing; T1566.001 Spearphishing Attachment

Exfiltration

T1567 Exfiltration Over Web Service; T1567.002 Exfiltration to Cloud Storage

Resource Development

T1583.006 Web Services; T1585 Establish Accounts; T1587.001 Malware

Reconnaissance

T1591.002 Business Relationships

defense-impairment

T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs

Affected products and versions in HTML Phishing Attachment Uses "Comment Stuffing" to Evade

  • Generic — Email/Attachment Security Gateways (AI/NLP-based content scanners)
    Vulnerable versions: AI/NLP-based static content classifiers without rendered-DOM inspection
    Fixed in: N/A - detection engineering mitigation, not a patchable product defect
  • Microsoft — Teams / SharePoint (brand impersonated in phishing lure)
    Vulnerable versions: N/A - brand spoofed, not a vulnerable product
    Fixed in: N/A

Remediation for HTML Phishing Attachment Uses "Comment Stuffing" to Evade

Immediate actions

  • Block or quarantine inbound emails carrying oversized HTML/.xls.html attachments (>500KB) at the mail gateway
  • Block outbound/webmail traffic to known sending IP 35.195.254.112 pending further triage
  • Add detection rules for emails with null envelope-sender (MAIL FROM:<>), missing Date header, or out-of-range X-Priority values
  • Alert on outbound POST requests from user endpoints to formspark.io and other known form-backend-as-a-service domains (formspree.io, emailjs.com, formbold.com, submit-form.com) originating from browser-rendered HTML attachments
  • User awareness notice: Microsoft Teams/SharePoint 'Pending Approval' emails delivered as .xls.html attachments should be treated as phishing

Workarounds

  • Disable automatic rendering/preview of HTML attachments in email clients; require explicit user action and warning banner before opening .html/.xls.html attachments
  • Configure mail flow rules to strip or rename .html/.htm attachment extensions on inbound mail

Longer-term hardening

  • Deploy attachment sandboxing/detonation that inspects rendered DOM content rather than raw file size or top-level static text ratio, to defeat comment/CSS stuffing evasion
  • Tune AI/NLP-based email security tooling to strip or ignore HTML comments and non-rendered content before content-based classification, and to chunk/paginate oversized attachments rather than truncating or skipping them
  • Implement DMARC enforcement (p=reject) and reject unauthenticated mail claiming to originate from Microsoft/Teams-branded senders
  • Monitor for and restrict use of decoupled form-backend-as-a-service exfiltration channels via egress filtering or CASB/SWG category blocking of newly observed form-service domains
  • Track SANS ISC and related handler diaries for follow-on evolutions of stuffing-based AI-evasion techniques (comment stuffing, CSS stuffing, and future variants)

Weaknesses (CWE) in HTML Phishing Attachment Uses "Comment Stuffing" to Evade

CWE-451, CWE-472, CWE-1021

Timeline of HTML Phishing Attachment Uses "Comment Stuffing" to Evade

  • SANS ISC handler Jan Kopriva publishes an earlier related diary documenting 'CSS stuffing' — a 449 kB phishing page (hosted on Google Firebase Storage, using <html lang="zxx">) containing only ~10 kB of functional code, padded with ~439 kB of unused/renamed CSS plus a duplicated bootstrap.min.css to evade content-based scanners.
  • The phishing email is caught by a security solution on the Tuesday preceding the diary's publication (source states 'Tuesday'; exact calendar date approximated as the Tuesday immediately before the 2026-07-10 publish date).
  • TL-Intel Harness ingests the SANS ISC diary via RSS feed and opens threat TL-2026-1168 for tracking.
  • SANS ISC diary entry is last updated at 09:09:29 UTC on 2026-07-10, the same day as initial publication.
  • SANS ISC publishes the full technical diary entry describing the comment-stuffing evasion technique, infrastructure indicators, and phishing page behavior.
  • The functional ~11 kB phishing payload is found to render a fake SharePoint login page, pull the target's logo via the (now-defunct) Clearbit Logo API, block developer tools/view-source, and POST harvested credentials to the Formspark form-handling service.
  • Email header analysis shows the message was sent from IP 35.195.254.112 (Google Cloud), with null envelope-sender (MAIL FROM:<>), missing Date header, X-Priority set to out-of-range 0, no DKIM, and failed SPF/DMARC — consistent with a homemade script talking directly to a mail server.
  • Analysis reveals ~420 kB of the attachment (~97% of file size) is a single HTML comment after the closing </html> tag containing ~430,000 Unicode-escaped repetitions of the letter 'X', reconstituted via unescape() and document.write() — dubbed 'comment stuffing.'
  • SANS ISC handler Jan Kopriva analyzes a phishing email carrying a 2,589 kB HTML attachment ('<company_name>_Pending_Approvals#<digits>.xls.html') spoofing a Microsoft Teams/SharePoint pending-approval notification.

Sources cited for HTML Phishing Attachment Uses "Comment Stuffing" to Evade

Threats related to HTML Phishing Attachment Uses "Comment Stuffing" to Evade

Detection coverage for TL-2026-1168

As of 2026-07-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1168 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats