0

I received an email from an old colleague asking me to take a look at an attachment. The email didn’t seem suspicious at all, it contained all the right logos, etc. When I opened the attachment it asked me to click on a button, which I did, then it asked me for my login credentials. This was on my iPhone. I stupidly went on my PC so I could read the document better and opened the same attachment and got to the same screen, when I realized that this was obviously a scam. I didn’t enter any information in, but I’m worried that there still may be some sort of virus or Trojan.

I did some research and similar scams have occurred (eFax) but in those cases a word or excel document opened which would then run a macro and install some sort of virus / Trojan to steal personal and banking information. This doesn’t apply in my case as a HTML opened but I’m still really worried. I ran a full scan on my PC with windows defender and nothing came up.

Edit: I’m kind of freaking out at the moment because at this point there’s nothing I can do. 30 minutes after clicking the email attachment I turned off my internet for the laptop. Also I do not have any saved passwords on my computer. However, I have obviously entered passwords in my computer in the past. I also have some documents on my computer that contain very sensitive information. My intuition tells me that this would make it very difficult for the hacker to access my passwords as the last time I entered them must have been a few months ago as I barely use my laptop. Also, it is unlikely they would be able to scan the hundreds of documents on my computer and send it to them in 30 minutes… (can someone confirm for my sanity lol). Also nothing came up on the scan, which I know will not be perfect but…

Improve this question
4
  • You can't send JavaScript from an email, so unless it has phishing links then I guess yes.
    – Parking Master
    Nov 15, 2021 at 17:44
  • @ParkingMaster – While an email client won't execute JavaScript from the message body, a web browser may execute JS when the victim clicks on the attached HTML. That in turn may contain a vulnerability.
    – Adam Katz
    Nov 15, 2021 at 17:54
  • Right, but I was referring to the email attachment. But that's another vulnerability too.
    – Parking Master
    Nov 15, 2021 at 18:46
  • The HTML may contain some malware, but as well it may just looking like or redirecting to some legit site attempting to steal your credentials. This will often pass screening as the html itself doesn't contain anything wrong per se
    – gusto2
    Nov 16, 2021 at 0:45

2 Answers 2

Reset to default
2

Yes, HTML can indeed contain malware that causes harm to your computer and/or exfiltrates its data. (Not as much an old-school virus, but that I'm assuming you're using that term as a synonym for malware.)

Usually, this comes in the form of malicious JavaScript. For email bodies, you're typically safe since email clients (including most webmail implementations) will silently ignore JavaScript and most other dynamic code, though that isn't true of attachments when you open them in your web browser.

Sometimes, there are non-JS-related vulnerabilities from email-originating HTML, such as the recent MS Office 0-day (which abused the MSHTML renderer).

Improve this answer
0

A website contains multiple different kinds of code and any one of those could contain a virus. So, yes, it would be trivial to have malicious code in the HTML file you opened.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.