VBSpam Q2 2025 comparative review
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Virus Bulletin's Q2 email security test reveals advanced evasion via .htm and .svg attachments delivering payloads and credential-stealing malware.
Virus Bulletin conducted a Q2 2025 comparative test of 11 email security solutions against 129,754 emails across spam, malware, phishing and legitimate mail. The test identified two significant evasion techniques bypassing most participants' defenses: SVG attachments with embedded JavaScript that dynamically insert HTML and redirect users, and HTM attachments with malicious JavaScript that impersonate invoices and harvest credentials via Telegram API integration. The SVG campaign (subject 'SSA-2025-DUE3471') was active for 40 minutes on May 15, 2025. Most tested solutions achieved spam catch rates exceeding 90%, with eight solutions earning VBSpam+ certification (Bitdefender GravityZone Premium, FortiMail, Mimecast, N-able Mail Assure, N-able SpamExperts, Net At Work NoSpamProxy, SEPPmail.cloudfilter, Sophos Email) and two earning VBSpam awards (Rspamd Premium, Zoho Mail). The test highlights that signature-based detection alone is insufficient against modern file-format evasion, requiring advanced behavioral analysis and payload inspection on non-traditional attachment types.
Detection guidance
Browser Process Resolving Telegram Bot API Host
A web browser resolving api.telegram.org can indicate an HTM/HTML attachment with JavaScript sending harvested credentials to a Telegram bot. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Browser Process Resolving Telegram Bot API Host
description: Detects a web browser process querying api.telegram.org. Phishing HTM
attachments that impersonate invoices use JavaScript to post harvested credentials
to the Telegram Bot API, so a browser reaching this host is unusual outside Telegram-integrated
web apps. Matches the exfiltration channel, not a specific bot token or chat ID.
tags:
- attack.exfiltration
- attack.t1041
- attack.t1059.007
logsource:
category: dns_query
product: windows
detection:
selection:
QueryName|endswith: api.telegram.org
Image|endswith:
- \chrome.exe
- \msedge.exe
- \firefox.exe
- \iexplore.exe
- \brave.exe
- \opera.exe
condition: selection
falsepositives:
- Web-based internal tools or dashboards that legitimately call the Telegram Bot API
from the browser
- Developers testing Telegram bots in a browser
level: medium
id: 5534aa48-1e2b-526b-9960-c993cf75174c
status: experimental
author: Vorant
references:
- https://www.virusbulletin.com/virusbulletin/2025/06/vbspam-comparative-review
Outlook Launching Browser on SVG or HTM Attachment
Outlook opening an SVG/HTM attachment from its attachment cache in a browser, a delivery path for script-laden redirect and credential-harvesting attachments. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Outlook Launching Browser on SVG or HTM Attachment
description: Detects Outlook spawning a web browser to render an .svg, .htm or .html
attachment from the Outlook attachment cache. Phishing campaigns use these file
types with embedded JavaScript to build HTML dynamically, redirect victims or harvest
credentials. Generalises on the parent/child relation and file type, not on any
filename.
tags:
- attack.initial-access
- attack.t1566.001
- attack.execution
- attack.t1059.007
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: \OUTLOOK.EXE
selection_child:
Image|endswith:
- \chrome.exe
- \msedge.exe
- \firefox.exe
- \iexplore.exe
- \brave.exe
- \opera.exe
selection_file:
CommandLine|contains: \Content.Outlook\
selection_ext:
CommandLine|contains:
- .svg
- .htm
condition: selection_parent and selection_child and selection_file and selection_ext
falsepositives:
- Users legitimately opening HTML newsletters, reports or SVG graphics sent as attachments
- Internal workflows that distribute HTML forms by email
level: medium
id: b03591d6-2788-5fc5-b4ad-b0495b9b5dff
status: experimental
author: Vorant
references:
- https://www.virusbulletin.com/virusbulletin/2025/06/vbspam-comparative-review
1 more detection for this report is in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.virusbulletin.com/virusbulletin/2025/06/vbspam-comparative-review
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs