Is an HTML attachment safe to open?
An HTML file is a web page, and opening it runs any JavaScript it contains on your machine. HTML attachments are one of the most common phishing vehicles precisely because the browser does exactly what the file says.
How a .HTML file can do harm
- A pixel-perfect fake login page that sends your credentials to the attacker, with no server involved so filters see nothing
- HTML smuggling: script that assembles an executable or archive in the browser and triggers its download, bypassing network scanning
- Redirects to malicious sites after a delay or a click
- Exploits for browser bugs, though a current browser makes these rare
- Tracking beacons that confirm your address is live
What it cannot do
- Read your files or run programs on its own; the browser sandbox applies to local files too, with minor exceptions
- Do anything if you read it in a text editor instead of a browser
Signs of a suspicious .HTML file
- An .html or .htm attachment to an email about an invoice, a shared file, a voicemail, or a password
- A page that immediately asks you to sign in to Microsoft, Google or your bank
- A file that is mostly one long encoded string when viewed as text, which is what a smuggled payload looks like
- The address bar showing file:// while a page asks for credentials
Before you open it
- Never enter a password into a page opened from a file; real sign-in pages live at https:// addresses you can verify
- Open suspicious HTML in a text editor, or not at all; there is no legitimate reason to receive a web page as an attachment
- Keep the browser updated; the sandbox is your main defence
- Ask why someone would send a page instead of a link
Check that it really is a .HTML file
The first question for any suspicious file is whether it is what its name says. Drop it on the detector: it reads the bytes in your browser, reports the real type, and computes the SHA-256 you can look up on VirusTotal, all without the file leaving your machine.
What is a .HTML file?