HTML Phishing Attachment Uses "Comment Stuffing" to Evade AI-Based Detection (SharePoint/Teams Credential Harvesting via Formspark) — Threadlinqs Intelligence
As of 2026-07-10, HTML Phishing Attachment Uses "Comment Stuffing" to Evade AI-Based Detection (SharePoint/Teams Credential Harvesting via Formspark) is a medium-severity phishing threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 17 indicators of compromise.
Threat ID: TL-2026-1168 · Severity: MEDIUM · Status: ACTIVE · Category: PHISHING
SANS ISC handler Jan Kopriva identified a phishing campaign delivering an oversized (2,589 kB) HTML attachment spoofing Microsoft Teams/SharePoint "Pending Approvals" notifications. Roughly 420 kB of
On 2026-07-10, SANS Internet Storm Center handler Jan Kopriva published an analysis of a phishing email observed carrying an unusually large (2,589 kB) HTML attachment named in the pattern "<company_name>_Pending_Approvals#<digits>.xls.html", designed to impersonate a Microsoft Teams/SharePoint pending-approval notification. Examination of the email headers showed multiple spoofing and infrastructure red flags: the display name claimed to be "Microsoft Teams Notifications" while the envelope/reverse-path sender was null (MAIL FROM:<>), no Date header was present (rendering as "None" in Outlook), the X-Priority header was set to an out-of-range value of 0, no DKIM signature was present, and SPF/DMARC evaluation failed. The email was sent from IP 35.195.254.112, hosted on Google Cloud, with an SPF record fallback referencing the RFC 1918 (non-routable) address postmaster@[10.88.0.3] — behavior consistent with a homemade mailer script talking directly to a mail transfer agent rather than a commercial ESP or standard MTA software.
Of the 2,589 kB HTML attachment, only about 11 kB constitutes the actual functional phishing page; roughly 420 kB (~97% of the file) is a single HTML comment placed after the closing </html> tag, containing approximately 430,000 repetitions of the letter "X", each individually encoded as a Unicode escape sequence (\u0058) and reconstituted at render time via JavaScript's unescape() and document.write() functions. Because the padding sits inside an HTML comment and is never rendered, it is invisible to a human victim opening the attachment, but it dramatically alters the statistical/textual profile of the file as seen by static content scanners, heuristic classifiers, and LLM/NLP-based triage tools — the technique is designed either to dilute the ratio of malicious signal to total content, or to exceed the token/processing budget of automated AI-assisted detection pipelines, causing the file to be truncated, misclassified, or skipped.
Once opened, the visible portion of the HTML file renders a spoofed SharePoint credential-entry page. The page dynamically fetches the target organization's logo via the Clearbit Logo API (a now-defunct free logo-lookup service as of end-2025) to add a veneer of legitimacy, and includes basic anti-analysis JavaScript that attempts to intercept/block browser developer tools and the View Source (Ctrl+U) keyboard shortcut to hinder manual inspection. Submitted credentials are POSTed to the Formspark form-backend-as-a-service platform rather than to attacker-controlled infrastructure, a technique that has become common across HTML-attachment phishing campaigns (also observed abusing Formspree, EmailJS, formbold, and submit-form.com) precisely because it decouples credential exfiltration from the phishing page's own hosting, is difficult to block without impacting legitimate Formspark customers, and lets attackers rotate phishing page hosting freely while the collection endpoint persists.
This "comment stuffing" technique is a direct evolution of a related obfuscation approach the same SANS ISC handler documented on 2025-11-21: "CSS stuffing," in which a 449 kB credential-harvesting page (hosted on Google Firebase Storage) contained only ~10 kB of functional code, with the rest padded by renamed/modified copies of legitimate CSS and a duplicated bootstrap.min.css, additionally using the <html lang="zxx"> attribute (ISO 639-2 code for "no linguistic content") as a further evasion signal. Both techniques represent a broader trend of threat actors engineering phishing kits specifically to defeat AI/ML-based email and attachment security products, rather than only signature- or human-analyst-based defenses — an emerging counter-detection category security teams should track independent of any single campaign.
No CVE or software vulnerability is associated with this threat; it is a social-engineering/detection-evasion technique rather than an exploit. Severity is assessed as MEDIU
Weaknesses (CWE)
CWE-451, CWE-472, CWE-1021
Target sectors: all sectors generic credential-phishing lure, enterprise m365 users
Target regions: Global
Detections & IOCs
As of 2026-08-15, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 17 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
PHISHING, MEDIUM, threat intelligence, cybersecurity, T1566, T1566.001, T1027, T1685, T1027.006, T1685.005, T1497, T1539, T1056.003, T1119
