# VBSpam Q2 2025 comparative review

Published: 2025-06-18 · Severity: routine
Canonical: https://vorant.io/reports/b8ba6b71-a45a-5bed-92fc-4f97df3858f6/vbspam-q2-2025-comparative-review

> Virus Bulletin's Q2 email security test reveals advanced evasion via .htm and .svg attachments delivering payloads and credential-stealing malware.

Virus Bulletin conducted a Q2 2025 comparative test of 11 email security solutions against 129,754 emails across spam, malware, phishing and legitimate mail. The test identified two significant evasion techniques bypassing most participants' defenses: SVG attachments with embedded JavaScript that dynamically insert HTML and redirect users, and HTM attachments with malicious JavaScript that impersonate invoices and harvest credentials via Telegram API integration. The SVG campaign (subject 'SSA-2025-DUE3471') was active for 40 minutes on May 15, 2025. Most tested solutions achieved spam catch rates exceeding 90%, with eight solutions earning VBSpam+ certification (Bitdefender GravityZone Premium, FortiMail, Mimecast, N-able Mail Assure, N-able SpamExperts, Net At Work NoSpamProxy, SEPPmail.cloudfilter, Sophos Email) and two earning VBSpam awards (Rspamd Premium, Zoho Mail). The test highlights that signature-based detection alone is insufficient against modern file-format evasion, requiring advanced behavioral analysis and payload inspection on non-traditional attachment types.

## Detection guidance (public sample)

### Browser Process Resolving Telegram Bot API Host

ATT&CK: T1041

A web browser resolving api.telegram.org can indicate an HTM/HTML attachment with JavaScript sending harvested credentials to a Telegram bot. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Browser Process Resolving Telegram Bot API Host
description: Detects a web browser process querying api.telegram.org. Phishing HTM
  attachments that impersonate invoices use JavaScript to post harvested credentials
  to the Telegram Bot API, so a browser reaching this host is unusual outside Telegram-integrated
  web apps. Matches the exfiltration channel, not a specific bot token or chat ID.
tags:
- attack.exfiltration
- attack.t1041
- attack.t1059.007
logsource:
  category: dns_query
  product: windows
detection:
  selection:
    QueryName|endswith: api.telegram.org
    Image|endswith:
    - \chrome.exe
    - \msedge.exe
    - \firefox.exe
    - \iexplore.exe
    - \brave.exe
    - \opera.exe
  condition: selection
falsepositives:
- Web-based internal tools or dashboards that legitimately call the Telegram Bot API
  from the browser
- Developers testing Telegram bots in a browser
level: medium
id: 5534aa48-1e2b-526b-9960-c993cf75174c
status: experimental
author: Vorant
references:
- https://www.virusbulletin.com/virusbulletin/2025/06/vbspam-comparative-review
```

### Outlook Launching Browser on SVG or HTM Attachment

ATT&CK: T1566.001

Outlook opening an SVG/HTM attachment from its attachment cache in a browser, a delivery path for script-laden redirect and credential-harvesting attachments. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Outlook Launching Browser on SVG or HTM Attachment
description: Detects Outlook spawning a web browser to render an .svg, .htm or .html
  attachment from the Outlook attachment cache. Phishing campaigns use these file
  types with embedded JavaScript to build HTML dynamically, redirect victims or harvest
  credentials. Generalises on the parent/child relation and file type, not on any
  filename.
tags:
- attack.initial-access
- attack.t1566.001
- attack.execution
- attack.t1059.007
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \OUTLOOK.EXE
  selection_child:
    Image|endswith:
    - \chrome.exe
    - \msedge.exe
    - \firefox.exe
    - \iexplore.exe
    - \brave.exe
    - \opera.exe
  selection_file:
    CommandLine|contains: \Content.Outlook\
  selection_ext:
    CommandLine|contains:
    - .svg
    - .htm
  condition: selection_parent and selection_child and selection_file and selection_ext
falsepositives:
- Users legitimately opening HTML newsletters, reports or SVG graphics sent as attachments
- Internal workflows that distribute HTML forms by email
level: medium
id: b03591d6-2788-5fc5-b4ad-b0495b9b5dff
status: experimental
author: Vorant
references:
- https://www.virusbulletin.com/virusbulletin/2025/06/vbspam-comparative-review
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.virusbulletin.com/virusbulletin/2025/06/vbspam-comparative-review

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/b8ba6b71-a45a-5bed-92fc-4f97df3858f6/vbspam-q2-2025-comparative-review.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup