As one of the Internet’s core markup languages, HTML5 is all about making Web content clear and presentable. But security researchers found it may also be a great way for cybercriminals to effectively hide malware from software detection.

In a peer-reviewed paper from scholars at the University of Salerno and the Sapienza University of Rome, titled “Using HTML5 to Prevent Detection of Drive-By-Download Web Malware,” the authors outlined a series of techniques that could be used to fool antivirus tools, preventing them from identifying malware using the Web standard’s APIs.

There are different approaches to how malware could be prepared, distributed and executed in drive-by download attacks by unsuspecting users. But essentially, APIs such as Websocket, Canvas, Web Workers, IndexedDB and others can break malware into chunks and then reassemble it once the victim visits a website.

As Softpedia pointed out, the ideas in the research were carefully tested over a two-year period. Given that there are often bugs in commonly used browsers such as Microsoft’s Internet Explorer and Mozilla’s Firefox, there was no shortage of opportunities to see if the scheme worked. As in any scientific experiment, there was a control group of tests that used HTML5 obfuscation and a set that didn’t. Each time, malware analysis tools were only successful in picking up on the threat in the latter group.

One of the Italian researchers told SecurityWeek that the team not only used VirusTotal to see if it could be outsmarted by HTML5 obfuscation, but two well-known antivirus products, as well. Dynamic analysis of the tests was done using the Wepawet, a free tool that looks for threats in Flash, JavaScript and other files.

With the wave of recent attacks exploiting holes in browser plugins such as Adobe Flash, the research paper should be a wake-up call to makers of malware detection software to take a closer look at HTML5. Help Net Security noted that while in theory cybercriminals could use the results of the experiments for nefarious purposes, the researchers also outlined recommendations that could help mitigate the effectiveness of hiding malware through each of their techniques.

In other words, if malicious actors succeed in carrying out a set of malware attacks that leverage Web standards, the IT security industry can’t say it wasn’t warned.