The fix, in one snippet
const blob = new Blob([atob(data)], …);
a.href = URL.createObjectURL(blob); a.download = 'invoice.exe';Illustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
The scanner reads HTML, HTM and SVG files (and HTML attached to .eml messages) and looks for the combination that defines the technique: a large base64 string literal (typically tens of kilobytes), decoding with atob() or a TextDecoder / Uint8Array loop (often with an XOR or reverse step), construction of a Blob with an application/octet-stream or application/zip type, URL.createObjectURL(), and an <a download> element created dynamically and clicked from script, or the legacy navigator.msSaveOrOpenBlob. Where the blob is easy to decode, it is decoded and identified by magic bytes, and the inner file's name and type are reported, usually a zip, an ISO or an executable. Limits: a heavily obfuscated decoder can evade the patterns; an offline HTML tool that generates a CSV export uses the same APIs legitimately, which is why the inner type is shown.
Why it matters
Mail gateways scan attachments, but an .html attachment is just text; the payload exists only after the browser runs the script, and it lands in Downloads as a password-protected zip or an ISO chosen to evade the Mark of the Web. Nobelium used the technique in 2021, and Qakbot and Pikabot campaigns adopted it afterwards, often behind an "invoice" page that also shows a fake Adobe or Microsoft sign-in form. Anyone who opens HTML attachments is exposed, and corporate mail users are the most targeted.
How to fix it
Never open .html, .htm or .shtml attachments from email. If you opened one and a download appeared, do not open the download; delete both. You can confirm the pattern in a text editor:
var b = atob(payload); // decode
var blob = new Blob([bytes], {type: 'application/octet-stream'});
var a = document.createElement('a');
a.href = URL.createObjectURL(blob); a.download = 'Invoice.zip'; a.click();Keep SmartScreen and browser download protection on: Chrome and Edge do mark blob downloads, so the operating system still sees where the file came from. Administrators should block HTML attachments at the gateway. Guides: how to spot phishing, is this file safe? and scanning downloads before opening.
Where this fits
HTML file assembles a download in the browser is check 8 of 20 that the file malware scanner runs under file structure and malware indicators, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits File content does not match its extension (high), where the bytes inside the file identify a different format from the one its extension claims, such as a Windows program named as a PDF or a zip named as an image. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
HTML file assembles a download in the browser closes one route in. Immediately below it: Obfuscated or encoded script, where the script's code is deliberately hard to read: Encoded strings, character-code arrays or packed layers that hide what it does; Office document contains macros, where the Office document contains VBA macro code, which runs with your user privileges as soon as you click Enable Content; Office document loads a remote template, where the document is attached to a template at a remote address, so opening it silently fetches content from an external server.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: HTML file assembles a download in the browser (high severity)
Scanner check id: html-smugglingThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
References
Related guides
8 min read · Updated Sep 13, 2026
How to Spot Phishing: URLs, Lookalike Domains, Urgency and the Checks That Work
Phishing succeeds by looking legitimate at a glance. This guide teaches the checks that hold up: Reading a URL from the right end,...
Read the guide
8 min read · Updated Sep 16, 2026
Is This File Safe? A Step-by-Step Way to Judge a File Before Opening It
You have a file and you are not sure. This guide gives an order of checks: Where it came from, its real type, its hash, a scan, and the...
Read the guide
8 min read · Updated Sep 17, 2026
How to Scan Downloads Before Opening Them (and What Your Browser Already Does)
Browsers, operating systems and online scanners each check downloads differently. What happens between clicking a link and opening the...
Read the guide