# HTML Phishing Attachment Uses "Comment Stuffing" to Evade AI-Based Detection (SharePoint/Teams Credential Harvesting via Formspark)

> SANS ISC handler Jan Kopriva identified a phishing campaign delivering an oversized (2,589 kB) HTML attachment spoofing Microsoft Teams/SharePoint "Pending Approvals" notifications. Roughly 420 kB of the file's ~430,000 repeated "X" characters are Unicode-escaped and hidden inside a single HTML comment after the closing </html> tag, apparently to dilute the malicious-content ratio and overwhelm AI/NLP-based scanners. The functional ~11 kB phishing payload renders a fake SharePoint login and exfiltrates harvested credentials via the legitimate Formspark form-handling service.

- **Published:** 2026-07-10T00:00:00Z
- **Last reviewed:** 2026-07-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1168
- **ID:** TL-2026-1168
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-07-10, SANS Internet Storm Center handler Jan Kopriva published an analysis of a phishing email observed carrying an unusually large (2,589 kB) HTML attachment named in the pattern "<company_name>_Pending_Approvals#<digits>.xls.html", designed to impersonate a Microsoft Teams/SharePoint pending-approval notification. Examination of the email headers showed multiple spoofing and infrastructure red flags: the display name claimed to be "Microsoft Teams Notifications" while the envelope/reverse-path sender was null (MAIL FROM:<>), no Date header was present (rendering as "None" in Outlook), the X-Priority header was set to an out-of-range value of 0, no DKIM signature was present, and SPF/DMARC evaluation failed. The email was sent from IP 35.195.254.112, hosted on Google Cloud, with an SPF record fallback referencing the RFC 1918 (non-routable) address postmaster@[10.88.0.3] — behavior consistent with a homemade mailer script talking directly to a mail transfer agent rather than a commercial ESP or standard MTA software.

Of the 2,589 kB HTML attachment, only about 11 kB constitutes the actual functional phishing page; roughly 420 kB (~97% of the file) is a single HTML comment placed after the closing </html> tag, containing approximately 430,000 repetitions of the letter "X", each individually encoded as a Unicode escape sequence (\u0058) and reconstituted at render time via JavaScript's unescape() and document.write() functions. Because the padding sits inside an HTML comment and is never rendered, it is invisible to a human victim opening the attachment, but it dramatically alters the statistical/textual profile of the file as seen by static content scanners, heuristic classifiers, and LLM/NLP-based triage tools — the technique is designed either to dilute the ratio of malicious signal to total content, or to exceed the token/processing budget of automated AI-assisted detection pipelines, causing the file to be truncated, misclassified, or skipped.

Once opened, the visible portion of the HTML file renders a spoofed SharePoint credential-entry page. The page dynamically fetches the target organization's logo via the Clearbit Logo API (a now-defunct free logo-lookup service as of end-2025) to add a veneer of legitimacy, and includes basic anti-analysis JavaScript that attempts to intercept/block browser developer tools and the View Source (Ctrl+U) keyboard shortcut to hinder manual inspection. Submitted credentials are POSTed to the Formspark form-backend-as-a-service platform rather than to attacker-controlled infrastructure, a technique that has become common across HTML-attachment phishing campaigns (also observed abusing Formspree, EmailJS, formbold, and submit-form.com) precisely because it decouples credential exfiltration from the phishing page's own hosting, is difficult to block without impacting legitimate Formspark customers, and lets attackers rotate phishing page hosting freely while the collection endpoint persists.

This "comment stuffing" technique is a direct evolution of a related obfuscation approach the same SANS ISC handler documented on 2025-11-21: "CSS stuffing," in which a 449 kB credential-harvesting page (hosted on Google Firebase Storage) contained only ~10 kB of functional code, with the rest padded by renamed/modified copies of legitimate CSS and a duplicated bootstrap.min.css, additionally using the <html lang="zxx"> attribute (ISO 639-2 code for "no linguistic content") as a further evasion signal. Both techniques represent a broader trend of threat actors engineering phishing kits specifically to defeat AI/ML-based email and attachment security products, rather than only signature- or human-analyst-based defenses — an emerging counter-detection category security teams should track independent of any single campaign.

No CVE or software vulnerability is associated with this threat; it is a social-engineering/detection-evasion technique rather than an exploit. Severity is assessed as MEDIUM: the credential-harvesting outcome is a common and well-understood impact, but the novel AI-evasion padding technique and abuse of a legitimate SaaS exfiltration channel (Formspark) warrant tracking and detection-rule updates (e.g., flagging oversized HTML attachments with anomalously high ratio of comment/whitespace content, Unicode-escape-heavy JavaScript, and outbound POSTs to known form-backend-as-a-service domains).

## MITRE ATT&CK

- T1566 Phishing
- T1566.001 Spearphishing Attachment
- T1027 Obfuscated Files or Information
- T1685 Disable or Modify Tools
- T1027.006 HTML Smuggling
- T1685.005 Clear Windows Event Logs
- T1497 Virtualization/Sandbox Evasion
- T1539 Steal Web Session Cookie
- T1056.003 Web Portal Capture
- T1119 Automated Collection
- T1567 Exfiltration Over Web Service
- T1567.002 Exfiltration to Cloud Storage
- T1583.006 Web Services
- T1585 Establish Accounts
- T1587.001 Malware
- T1591.002 Business Relationships

## Sources

- ["Comment stuffing" in an HTML phishing attachment as a mechanism for evading AI-based detection?](https://isc.sans.edu/diary/rss/33144)
- [Use of CSS stuffing as an obfuscation technique?](https://isc.sans.edu/diary/32510)
- [HTML phishing attachments - now with anti-analysis features](https://isc.sans.edu/diary/28702)
- ["Passive" analysis of a phishing attachment - SANS ISC](https://isc.sans.edu/diary/rss/29798)
- [Phishing page with trivial anti-analysis features - SANS ISC](https://isc.sans.edu/diary/30412)
- ['Sign in to continue' and suffer: Attackers abusing legitimate services for credential theft](https://blog.checkpoint.com/security/sign-in-to-continue-and-suffer-attackers-abusing-legitimate-services-for-credential-theft/)
- [Phorm Phishing: Using Form Service APIs to Steal Credentials](https://emailsecurity.checkpoint.com/blog/phorm-phishing-using-form-service-apis-to-steal-credentials)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1168