Cisco Talos Details How Attackers Abuse CSS to Evade Email Filters and Track Recipients
Summary
Cisco Talos describes observed phishing and spam campaigns that use CSS to hide content from email filters and track recipients’ actions, preferences, and device details, and recommends filtering and email privacy proxies.
Key points
- Talos observed CSS abuse in the wild from the second half of 2024 through February 2025.
- Attackers used hidden text salting, including text-indent, opacity, clipping, and other CSS properties, to conceal irrelevant content in phishing emails and HTML attachments.
- One spear-phishing example used an HTML attachment and hidden German text to evade detection while directing recipients toward a phishing page.
- Tracking methods recorded email opens, printing, client type, color-scheme preferences, and—in some cases—IP address and device information.
- CSS media rules and font availability can be used to infer screen characteristics and potentially identify a recipient’s operating system.
- Talos recommends filtering that examines hidden content and visual email characteristics, plus privacy proxies that rewrite styles and embed remote resources.
Article Details
- Attack Vectors
- Phishing and spear-phishing emails conceal irrelevant text with CSS properties to evade spam filters and detection engines.
- A spear-phishing email used an HTML attachment with HTML smuggling to redirect the recipient to a phishing page.
- Spam emails used tracking images, pixels, and URLs to record email opens, printing, client and color-scheme preferences, IP addresses, and device information.
- CSS media rules and font availability can be used to fingerprint recipients’ screen characteristics and infer their operating systems.
- Defensive Notes
- Use advanced email filtering that examines hidden content and multiple parts of messages.
- Consider visual email characteristics in detection, particularly for image-based threats.
- Use email privacy proxies that convert top-level CSS rules into style attributes and rewrite remote resources as data URLs to reduce tracking and information exfiltration.
MITRE ATT&CK
T1027.006 · HTML SmugglingThe article explicitly describes HTML smuggling in an HTML attachment used to redirect the recipient to a phishing page.T1566.001 · Spearphishing AttachmentA spear-phishing email sent to a customer included an HTML attachment intended to persuade the recipient to click through to a phishing page.