Attackers are hiding malicious payloads in phishing emails via a technique traditionally used to hide malicious code planted on websites.