---
title: New Phishing Attacks Use HTML Email Attachments
description: New Phishing Attacks Use HTML Email Attachments
---
[Securafy Knowledge Hub](https://blog.securafy.com)
- [Topics](https://blog.securafy.com/#sf-cover)
- [Tools](https://blog.securafy.com/#sf-tools)
- [Books & Guides](https://blog.securafy.com/#sf-books)
[Talk to Securafy](https://meetings.hubspot.com/securafy/strategy-call)
[Topics](https://blog.securafy.com/#sf-cover) [Tools](https://blog.securafy.com/#sf-tools) [Books & Guides](https://blog.securafy.com/#sf-books) [Talk to Securafy](https://meetings.hubspot.com/securafy/strategy-call)
[Knowledge Hub](https://blog.securafy.com) / IT Operations
IT Operations
# New Phishing Attacks Use HTML Email Attachments
New Phishing Attacks Use HTML Email Attachments
 By Randy Hall Updated Nov 2025 2 min read Share [**](https://www.linkedin.com/sharing/share-offsite/?url=https://blog.securafy.com/2022/06/13/new-phishing-attacks-use-html-email-attachments) [**](https://twitter.com/intent/tweet?url=https://blog.securafy.com/2022/06/13/new-phishing-attacks-use-html-email-attachments&text=%3Cspan+id%3D%22hs_cos_wrapper_name%22+class%3D%22hs_cos_wrapper+hs_cos_wrapper_meta_field+hs_cos_wrapper_type_text%22+style%3D%22%22+data-hs-cos-general-type%3D%22meta_field%22+data-hs-cos-type%3D%22text%22+%3E%C2%A0New+Phishing+Attacks+Use+HTML+Email+Attachments%3C%2Fspan%3E) [**](mailto:?subject=%3Cspan+id%3D%22hs_cos_wrapper_name%22+class%3D%22hs_cos_wrapper+hs_cos_wrapper_meta_field+hs_cos_wrapper_type_text%22+style%3D%22%22+data-hs-cos-general-type%3D%22meta_field%22+data-hs-cos-type%3D%22text%22+%3E%C2%A0New+Phishing+Attacks+Use+HTML+Email+Attachments%3C%2Fspan%3E&body=https://blog.securafy.com/2022/06/13/new-phishing-attacks-use-html-email-attachments)
HTML attachments as an attack vector may seem a little old school. However, according to statistics compiled by Kaspersky Lab indicates that in 2022, that form of attack is not just simply still being employed, but hackers are making surprisingly regular use of it. The security company detected more than two million emails of this kind targeting Kaspersky customers in the first four months of the year (2022).
**The specific breakdown of monthly instances looks like this:**
- January 2022: 299,859 instances
- February 2022: 451,020 instances
- March 2022: 851,328 instances
- And April 2022: 386,908 instances
The researchers aren't clear on exactly what caused the huge spike in March but they note that it returned to expected levels the month following.
Using HTML attachments as an attack vector saw a big spike in 2019 and then it seemed to fall out of favor. The number of instances dropped markedly and prompted some security researchers to conclude that, based on current trajectories, the attack vector was on the way out.
The last four months seem to have disproved that notion and HTML attachments are back in fashion in the underbelly of the web.
It's important to remember that merely opening these files is in many cases enough to have JavaScript run on your system. That could lead to the target system being hijacked using a malware-assembly-on-disk scheme that could allow it to bypass antivirus software entirely.
This isn't something that gets mentioned very often in employee email safety training, but it should be.
As ever, the best defense against any type of phishing attack is to treat any incoming email message from a sender you don't know with a healthy dose of skepticism. If that email contains an attachment, those attachments should be treated even more skeptically.
Tagged Under IT Operations[Cybersecurity](https://blog.securafy.com/tag/cybersecurity)Business ContinuityAI Governance
In This Article
Need Help With Your Current Setup?
Talk through your current systems, risks, and support gaps with Securafy.
[Book a Strategy Call](https://meetings.hubspot.com/securafy/strategy-call)
## Join The Conversation
Have a question or perspective on this topic? Add it below.
About The Author
Randy Hall · CEO & Founder
Randy Hall is the CEO and Founder of Securafy, with decades of experience helping organizations make smarter, safer decisions about technology.
A frequent speaker and instructor at national IT events, Randy has advised thousands of organizations, from startups and SMBs to large enterprises and U.S. government entities, on secure, practical technology adoption. He writes about the decisions business leaders are often expected to make without enough context, including cybersecurity, compliance, AI, cyber insurance, IT strategy, and business resilience.
Outside the office, you’ll often find Randy on Lake Erie enjoying time on his 38-foot Chris-Craft.
**Writes about:** Cybersecurity strategy, compliance, AI security, business resilience, cyber insurance, SMB risk, IT leadership
[More From This Author →](https://blog.securafy.com/author/randyhall)
Related Articles
Business Continuity [Compliance Risk Assessment: How Downtime Impacts Your Bottom Line](https://blog.securafy.com/compliance-risk-assessment-how-downtime-impacts-your-bottom-line)
When systems go down, compliance obligations don't pause—and the financial consequences ...
Jul 28, 2026
Compliance [HIPAA Security Rule Changes Are Delayed To 2027: Why Healthcare Organizations Should Not Wait](https://blog.securafy.com/hipaa-security-rule-changes-are-delayed-to-2027-why-healthcare-organizations-should-not-wait)
The updated HIPAA Security Rule won't take effect until 2027, but healthcare ...
Jul 23, 2026
Compliance [Multi Factor Authentication Best Practices for CJIS Security Policy Compliance](https://blog.securafy.com/multi-factor-authentication-best-practices-for-cjis-security-policy-compliance)
Law enforcement agencies and criminal justice organizations face mounting pressure to ...
Jul 16, 2026
Compliance [CMMC Phase II Has Been Suspended: What Defense Contractors Still Need To Do](https://blog.securafy.com/cmmc-phase-ii-has-been-suspended-what-defense-contractors-still-need-to-do)
The Department of Defense suspended CMMC Phase II enforcement, but that doesn't mean ...
Jul 15, 2026
IT Operations [Cybersecurity For Veterinary Clinics: Protecting Client Data, Payment Systems, And Practice Operations](https://blog.securafy.com/cybersecurity-for-veterinary-clinics-protecting-client-data-payment-systems-and-practice-operations)
Veterinary clinics handle sensitive client data, payment information, and critical ...
Jul 9, 2026
IT Operations [AT&T Cybersecurity, AlienVault USM, And Managed Security: What SMBs Still Need To Own](https://blog.securafy.com/att-cybersecurity-alienvault-usm-and-managed-security-what-smbs-still-need-to-own)
Managed security platforms like AT&T Cybersecurity and AlienVault USM provide ...
Jul 8, 2026
Get Practical Cybersecurity Field Notes
Monthly cybersecurity, compliance, and IT strategy updates from Securafy, written for business owners who need clear next steps.
- Practical security tips from our Cyber Security Drip series
- The Securafy Times, our monthly roundup on compliance and IT strategy
- Occasional updates on new tools, guides, and research
- No spam — unsubscribe anytime
NIST CSF 2.0 Zero Trust Application Control CISA Aligned Enterprise Partner
© 2026 Securafy — Columbus & Cleveland, Ohio
[Main Site](https://www.securafy.com/) [Blog Home](https://blog.securafy.com/) [Contact](https://www.securafy.com/contact.html) [Privacy Policy](https://www.securafy.com/privacy-policy.html)
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Randy Hall",
"url" : "https://blog.securafy.com/author/randyhall"
},
"dateModified" : "2025-11-04T18:38:49.050Z",
"datePublished" : "2022-06-13T15:00:00.000Z",
"headline" : " New Phishing Attacks Use HTML Email Attachments",
"mainEntityOfPage" : {
"@id" : "https://blog.securafy.com/2022/06/13/new-phishing-attacks-use-html-email-attachments",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.securafy.com/hubfs/securafy-logo.png"
},
"name" : "Securafy Inc."
}
}
```
```json
{
"@context" : "https://schema.org",
"@id" : "https://securafy.com/#organization",
"@type" : "Organization",
"address" : [ {
"@type" : "PostalAddress",
"addressLocality" : "Columbus",
"addressRegion" : "OH",
"postalCode" : "43219",
"streetAddress" : "4449 Easton Way, Suite 200"
}, {
"@type" : "PostalAddress",
"addressLocality" : "Independence",
"addressRegion" : "OH",
"postalCode" : "44131",
"streetAddress" : "6100 Oak Tree Blvd, Suite 200"
} ],
"areaServed" : [ "Columbus OH", "Cleveland OH", "Ohio" ],
"name" : "Securafy Inc.",
"url" : "https://securafy.com/"
}
```
```json
{
"@context" : "https://schema.org",
"@id" : "https://securafy.com/#website",
"@type" : "WebSite",
"inLanguage" : "en-US",
"name" : "Securafy",
"publisher" : {
"@id" : "https://securafy.com/#organization"
},
"url" : "https://securafy.com/"
}
```
```json
{
"@context" : "https://schema.org",
"@id" : "https://blog.securafy.com/#blog",
"@type" : "Blog",
"name" : "Securafy Knowledge Hub",
"publisher" : {
"@id" : "https://securafy.com/#organization"
},
"url" : "https://blog.securafy.com"
}
```
```json
{
"@context" : "https://schema.org",
"@id" : "https://blog.securafy.com/2022/06/13/new-phishing-attacks-use-html-email-attachments#article",
"@type" : "Article",
"author" : {
"@id" : "https://www.securafy.com/about-us/#randyhall",
"@type" : "Person",
"name" : "Randy Hall"
},
"dateModified" : "2025-11-04T18:38:49+00:00",
"datePublished" : "2022-06-13T15:00:00+00:00",
"description" : "New Phishing Attacks Use HTML Email Attachments",
"headline" : "New Phishing Attacks Use HTML Email Attachments",
"image" : "https://www.securafy.com/hs-fs/hubfs/securafy-og-default.jpg",
"inLanguage" : "en-US",
"isPartOf" : {
"@id" : "https://blog.securafy.com/#blog"
},
"mainEntityOfPage" : {
"@id" : "https://blog.securafy.com/2022/06/13/new-phishing-attacks-use-html-email-attachments",
"@type" : "WebPage"
},
"publisher" : {
"@id" : "https://securafy.com/#organization"
},
"url" : "https://blog.securafy.com/2022/06/13/new-phishing-attacks-use-html-email-attachments"
}
```
```json
{
"@context" : "https://schema.org",
"@type" : "BreadcrumbList",
"itemListElement" : [ {
"@type" : "ListItem",
"item" : "https://blog.securafy.com",
"name" : "Knowledge Hub",
"position" : 1
}, {
"@type" : "ListItem",
"item" : "https://blog.securafy.com/2022/06/13/new-phishing-attacks-use-html-email-attachments",
"name" : "New Phishing Attacks Use HTML Email Attachments",
"position" : 2
} ]
}
```