Avanan researchers have seen a new attack dubbed “Blank Image” spreading throughout the globe wherein hackers include blank images in HTML attachments. When opening the attachment, the user is automatically redirected to a malicious URL
The link to DocuSign will take you to the official DocuSign website if they click the “View Completed Document” button the “Blank Image” assault is launched if they try to open the HTML attachment.
@ecksmc A4 white paper Chinese protest. Maybe that's the origin of this attack. Just me guessing.
I try not to speculate
“It bypasses VirusTotal and doesn’t even get scanned by traditional Click-Time Protection”, researchers