What are highly evasive adaptive threats (HEAT)?

Last updated: 2026-08-20Browser Security

Highly evasive adaptive threats (HEAT) are web-borne attacks specifically engineered to bypass detection-based security — secure web gateways, email filters, sandboxes and signature engines. They use techniques like brand-new domains, content assembled in the browser at runtime, and abuse of trusted sites, so that nothing looks malicious until the attack is already executing on the endpoint.

Also known as: highly evasive adaptive threats · evasive web threats · HTML smuggling attacks · zero-hour phishing

Common HEAT techniques

Typical patterns include phishing kits hosted on newly registered or reputable-but-compromised domains that blocklists have not caught up with; HTML smuggling, where the malicious payload is constructed by JavaScript inside the browser so network inspection sees only harmless fragments; and malicious content hidden behind CAPTCHAs or user interaction, which automated sandboxes never trigger.

Why detection struggles

Every detection engine must answer "is this malicious?" before the content runs. HEAT techniques are built to make that answer come back wrong or too late. Browser isolation sidesteps the question: all web content executes in a remote container regardless of classification, so an undetected attack still never reaches the device.

// In the Cyberdis portfolio

Menlo Security neutralizes evasive web threats through isolation — distributed by Cyberdis.

Explore Menlo Security Request a PoC

// FAQ

Common questions.

Are HEAT attacks the same as zero-days?

No. A zero-day exploits an unknown software vulnerability; a HEAT attack evades detection regardless of whether the underlying technique is new. Most HEAT attacks use well-known methods (phishing, smuggled payloads) delivered in ways inspection engines cannot classify in time.

What stops HEAT attacks?

Architecturally, isolation: executing all web content remotely removes the dependency on recognizing the threat. Menlo Security built its platform around this model and coined the HEAT terminology in its threat research.

Who is most targeted by evasive web threats?

Credential-rich users: executives, finance teams, IT administrators and — increasingly — AI agents operating in browsers with delegated permissions.

Weighing approaches? Browser isolation vs secure web gateway: what actually stops web threats?