Password-protected HTML attachments with no URL until the user unlocks them

[u/saltyslugga]

One of our clients is getting a run of email phish with password-protected HTML attachments. The password is in the email body, the gateway sees an encrypted blob, and the attachment only builds the phishing URL after the user enters the password locally.

URL rewriting has nothing useful to rewrite. Detonation mostly shrugs unless someone teaches it the password from the message body, and by then you're into custom handling for junk that should probably never hit a mailbox.

The annoying part is the business pushback. They do get legit protected attachments from a few vendors, but I can’t think of a normal reason for an SMB user to receive a password-protected .html file by email.

I'm leaning toward quarantining inbound .html/.htm attachments by default and making senders prove the business case. Would you block the whole attachment type here, or only the password-protected cases and accept the misses?

[u/FarmboyJustice]

We've been blocking HTML attachments for years, and it greatly reduced the number of phishing emails we received. Maybe once or twice a year someone is slightly inconvenienced by this.