SHTML Phishing Attack with blurred image

Authored By Anuradha

McAfee Labs has recently observed a new wave of phishing attacks. In this wave, the attacker has been abusing server-parsed HTML (SHTML) files. The SHTML files are commonly associated with web servers redirecting users to malicious, credential-stealing websites or display phishing forms locally within the browser to harvest user-sensitive information. 

 SHTML Campaign in the field: 

 Figure 1. shows the geological distribution of McAfee clients who detect malicious SHTML files. 

Figure 1. McAfee Client Detection of SHTML 

Attackers …

abusing attack attacks blurred browser credential display files forms html information labs locally malicious mcafee phishing phishing attack phishing attacks sensitive information server servers stealing web websites