---
title: "The Login Page in Your Inbox: How HTML Phishing Attachments Work"
description: A local web page shows your sign-in screen, address filled in, and posts the password to an attacker. A scanner finds nothing in it.
image: https://explore.bowbridge.net/hubfs/Blog/File%20Security%20101/Headers/File%20Security%20101%20-%20Blog%20Header.jpeg
---
[customer login](https://www.bowbridge.net/customer-portal/) english deutsch
[](https://www.bowbridge.net/en/)
- [Solutions](https://www.bowbridge.net/en/sap-cybersecurity-solutions/)
- [Anti-Virus - Cloud](https://www.bowbridge.net/en/anti-virus-cloud-for-sap-solutions/)
- [Anti-Virus for SAP Solutions](https://www.bowbridge.net/en/anti-virus-for-sap-solutions/)
- [Application Security for SAP Solutions](https://www.bowbridge.net/en/application-security-for-sap-solutions/)
- [Resources](https://www.bowbridge.net/en/sap-cybersecurity-resources/)
- [Blog](https://explore.bowbridge.net/blog)
- [Protecting SAP Applications from Content-Based Attacks](https://www.bowbridge.net/en/guide-to-content-based-attacks-sap-applications/)
- [Intro to FIORI Cybersecurity](https://www.bowbridge.net/en/guide-to-sap-fiori-cybersecurity/)
- [Case Studies](https://www.bowbridge.net/en/sap-cybersecurity-resources/#casestudies)
- [White Papers](https://www.bowbridge.net/en/sap-cybersecurity-resources/#wp)
- [Webinars](https://www.bowbridge.net/en/sap-cybersecurity-resources/#webinars)
- [Partner Resources](https://www.bowbridge.net/en/bowbridge-partner-resources/)
- [About](https://www.bowbridge.net/en/about-bowbridge-software/)
- [Company Profile](https://www.bowbridge.net/en/company-profile/)
- [Customers](https://www.bowbridge.net/en/customers/)
- [News](https://explore.bowbridge.net/news)
- [Careers](https://www.bowbridge.net/en/careers/)
- [Support](https://www.bowbridge.net/en/sap-cybersecurity-support/)
- [Software Downloads](https://www.bowbridge.net/en/bowbridge-downloads/)
- [Documentation](https://www.bowbridge.net/en/bowbridge-documentation/)
- [Support Videos](https://www.bowbridge.net/en/bowbridge-support-videos/)
- [Contact Technical Support](https://www.bowbridge.net/en/sap-cybersecurity-support/#form)
- [Contact](https://www.bowbridge.net/en/contact-bowbridge/)
- [DE](https://www.bowbridge.net/de/)
- [EN](https://www.bowbridge.net/en/news.html)
- [Solutions](https://www.bowbridge.net/en/sap-cybersecurity-solutions/)
- [Anti-Virus - Cloud](https://www.bowbridge.net/en/anti-virus-cloud-for-sap-solutions/)
- [Anti-Virus for SAP Solutions](https://www.bowbridge.net/en/anti-virus-for-sap-solutions/)
- [Application Security for SAP Solutions](https://www.bowbridge.net/en/application-security-for-sap-solutions/)
- [Resources](https://www.bowbridge.net/en/sap-cybersecurity-resources/)
- [Blog](https://explore.bowbridge.net/blog)
- [Protecting SAP Applications from Content-Based Attacks](https://www.bowbridge.net/en/guide-to-content-based-attacks-sap-applications/)
- [Intro to FIORI Cybersecurity](https://www.bowbridge.net/en/guide-to-sap-fiori-cybersecurity/)
- [Case Studies](https://www.bowbridge.net/en/sap-cybersecurity-resources/#casestudies)
- [White Papers](https://www.bowbridge.net/en/sap-cybersecurity-resources/#wp)
- [Webinars](https://www.bowbridge.net/en/sap-cybersecurity-resources/#webinars)
- [Partner Resources](https://www.bowbridge.net/en/bowbridge-partner-resources/)
- [About](https://www.bowbridge.net/en/about-bowbridge-software/)
- [Company Profile](https://www.bowbridge.net/en/company-profile/)
- [Customers](https://www.bowbridge.net/en/customers/)
- [News](https://explore.bowbridge.net/news)
- [Careers](https://www.bowbridge.net/en/careers/)
- [Support](https://www.bowbridge.net/en/sap-cybersecurity-support/)
- [Software Downloads](https://www.bowbridge.net/en/bowbridge-downloads/)
- [Documentation](https://www.bowbridge.net/en/bowbridge-documentation/)
- [Support Videos](https://www.bowbridge.net/en/bowbridge-support-videos/)
- [Contact Technical Support](https://www.bowbridge.net/en/sap-cybersecurity-support/#form)
- [Contact](https://www.bowbridge.net/en/contact-bowbridge/)
# The Login Page in Your Inbox: How HTML Phishing Attachments Work
Nov 10, 2026, 1:00:00 PM by Joerg Schneider-Simon
An HTML attachment can show a perfect copy of your company's sign-in page and send whatever you type to an attacker, without containing a single line of malware. This is episode 2 of File Security 101, our series on file-based threats your anti-malware does not see.
The video explains it in about two minutes.
The article adds the details and the research behind it.
## A message that asks you to sign in
The mail announces a secure message, and the attachment is called something like `secure-message.html`. When it is opened, the browser shows the company's sign-in page: the logo, a password box, and the recipient's e-mail address already filled in. The page asks the user to sign in again. To most people that looks like a routine request.
## An HTML file is a web page
An HTML file is a complete web page that travels as a file. A double-click opens it in the default browser, straight from the local disk. Images can be carried inside the file itself as `data:` URLs, so the page needs nothing from the internet to look right.
A sign-in box on such a page is an ordinary HTML form. Its `action` attribute holds the address the browser sends the typed data to when the user clicks the button. That address is the only part of the form that decides where a password ends up.
## The attack: a different destination
The attacker copies the real sign-in page and changes one thing: the form's `action` now points to a server the attacker controls. A hidden input field, invisible on the page, carries a campaign or victim identifier, so the attacker knows which mail produced which password. Because the attacker prepares the file for each recipient, the e-mail address can be filled in in advance, which makes the page look even more genuine.
When the user clicks Sign in, the browser posts the user name and password to the attacker's server. That server can then send the browser on to the real sign-in page, so the user sees what looks like a short glitch and signs in again. The attacker now holds valid credentials and can sign in as the user, to mail, to cloud storage, or to any other service that accepts the same password.
## It happened
In August 2021, Microsoft described a phishing campaign it had tracked for a year, from July 2020 to July 2021 ([Microsoft Security Blog](https://www.microsoft.com/security/blog/2021/08/12/attackers-use-morse-code-other-encryption-methods-in-evasive-phishing-campaign)). The attachments were HTML files whose names ended in variations of `xls.HTML`, so that recipients expected an Excel file. When opened, they showed a fake Office 365 sign-in dialog over a blurred spreadsheet and asked the user to re-enter the password because the session had supposedly timed out. The dialog could show the target's e-mail address and, in some instances, the company logo.
The attackers split the page's code into several encoded segments, some of them in Morse code, and changed their obfuscation and encryption on average every 37 days. Microsoft counted ten iterations of the campaign. Captured credentials were posted to the attacker's server. A later wave also collected the victim's IP address and country, and the July 2021 wave sent victims on to the legitimate Office 365 page after they entered their password.
## Why nobody notices
The page opens from the local disk, so the address bar shows a file, not a suspicious website. A malware scanner finds nothing, because nothing in the file is malicious: a sign-in form is one of the most common things on the web. What makes this file phishing is only the destination of the data, and that destination is just a web address. Encoding the page in pieces, as in the campaign above, makes even that address hard to see for filters that look for known phishing domains.
## What to do
- Treat any attachment that asks for a password as phishing. Real services never ask you to sign in from an HTML file in your mail.
- If you are unsure, close the file and open the service the way you always do: a bookmark, or the address you know.
- Report the mail, so that others who received the same campaign can be warned.
Training helps, but one convincing page on one busy day is enough. bowbridge Content Disarm and Reconstruct takes the HTML file apart and builds a new one from its text and layout only. The form's destination, the hidden fields and any scripts are not copied, and a password box becomes an ordinary text box. The rebuilt page can still be read, but it has nowhere to send anything.
[Join the bowbridge CDR beta program](https://explore.bowbridge.net/en/cdr-beta)
## Sources
- [Attackers use Morse code, other encryption methods in evasive phishing campaign](https://www.microsoft.com/security/blog/2021/08/12/attackers-use-morse-code-other-encryption-methods-in-evasive-phishing-campaign), Microsoft Security Blog, August 12, 2021
## Subscribe to upcoming episodes
#### Share this on social:
[Share via LinkedIn](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fexplore.bowbridge.net%2Ffile-security-101%2Fepisode-2-the-login-page-in-your-inbox&title=The+Login+Page+in+Your+Inbox%3A+How+HTML+Phishing+Attachments+Work&summary=A+local+web+page+shows+your+sign-in+screen%2C+address+filled+in%2C+and+posts+the+password+to+an+attacker.+A+scanner+finds+nothing+in+it.) [Share via Twitter](https://twitter.com/intent/tweet?url=https%3A%2F%2Fexplore.bowbridge.net%2Ffile-security-101%2Fepisode-2-the-login-page-in-your-inbox&text=The+Login+Page+in+Your+Inbox%3A+How+HTML+Phishing+Attachments+Work) [Share via Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fexplore.bowbridge.net%2Ffile-security-101%2Fepisode-2-the-login-page-in-your-inbox) [Share via Email](mailto:?subject=The+Login+Page+in+Your+Inbox%3A+How+HTML+Phishing+Attachments+Work&body=https%3A%2F%2Fexplore.bowbridge.net%2Ffile-security-101%2Fepisode-2-the-login-page-in-your-inbox)
### Don't miss the latest SAP security news
#### bowbridge
- [Solutions](https://www.bowbridge.net/en/sap-cybersecurity-solutions/)
- [Resources](https://www.bowbridge.net/en/sap-cybersecurity-resources/)
- [About bowbridge](https://www.bowbridge.net/en/about-bowbridge-software/)
- [Support](https://www.bowbridge.net/en/sap-cybersecurity-support/)
- [Contact](https://www.bowbridge.net/en/contact-bowbridge/)
- [Customer Login](https://www.bowbridge.net/customer-portal/)
#### Contact
**GERMANY**
Tel: +49 (0) 6227 - 69899 - 50
Fax: +49 (0) 6227 - 69899-59
Email: [info@bowbridge.net](mailto:info@bowbridge.net)
**USA**
Tel: +1 650 - 617 - 3408
Fax: +1 650 - 617 - 3201
Email: [us-sales@bowbridge.net](mailto:us-sales@bowbridge.net)
#### Connect With Us
- [English](https://www.bowbridge.net/en/)
- [Deutsch](https://www.bowbridge.net/)
Copyright © 2023 bowbridge Software GmbH. All rights reserved. [Privacy Policy](https://www.bowbridge.net/en/privacy-policy)
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Joerg Schneider-Simon",
"url" : "https://explore.bowbridge.net/file-security-101/author/joerg-schneider-simon"
},
"dateModified" : "2026-11-10T13:10:38.451Z",
"datePublished" : "2026-11-10T12:00:00.000Z",
"headline" : "The Login Page in Your Inbox: How HTML Phishing Attachments Work",
"image" : [ "https://explore.bowbridge.net/hubfs/Blog/File%20Security%20101/Headers/File%20Security%20101%20-%20Blog%20Header.jpeg" ],
"mainEntityOfPage" : {
"@id" : "https://explore.bowbridge.net/file-security-101/episode-2-the-login-page-in-your-inbox",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://explore.bowbridge.net/hubfs/bowbridge_logo_2-1.png"
},
"name" : "bowbridge Software GmbH"
}
}
```