Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I just got one like this 5 minutes ago. They are getting clever i saw that they are embedding this.

onload="document.location.replace(window.atob('aHR0cHM6Ly9ibG9jay1jaGFpbi1ib3gudGsvbXpwaWwvP3RldHRoa3Yg'));"

Which if you decode you get a strange domain.

I assume gmail only looks for urls which in this case is not visible without decoding it



I thought you couldn't embed scripts/iframes into a html email?


These emails often include an attachment with an HTML file. My guess is depending on your client, it might just open a new browser window with the file (after it’s downloaded)


It is in an attached file. In my case the file is named

"Profitability 28388 .htm"


That looks legit.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: