Executive Summary
A sophisticated phishing campaign has been identified using large HTML attachments to bypass Secure Email Gateways (SEGs). The attack utilizes a 1 MB HTML file, which is specifically sized to exceed the processing limits of many deep content inspection engines. Because the phishing page renders locally in the victim's browser, there are no malicious URLs within the email body for reputation-based filters to detect.
The delivery mechanism is highly evasive, originating from authenticated Gmail accounts that pass SPF, DKIM, and DMARC checks. This suggests the use of compromised legitimate accounts to lend credibility to the sender's identity. The minimal email body and lack of external links mean traditional signature-based and reputation-based security layers often return a clean verdict.
This threat highlights a critical shift toward identity-based and evasive delivery tactics. Organizations relying solely on legacy gateway solutions are at high risk, as the technique effectively neutralizes standard scanning protocols. Protection requires behavioral analysis of sender relationships and the ability to remediate threats post-delivery.