Abusing with style: Leveraging cascading style sheets for evasion and tracking
Summary: Cisco Talos documented CSS abuse in phishing and spam emails observed from the second half of 2024 through February 2025, using properties such as text-indent set to -9999px, zero opacity, zero width and height, and clip-path to hide gibberish text and preheader content from recipients while affecting parsers and detection engines. Talos also described CSS-based tracking that logs when an email is opened, printed, or viewed in a specific client, records color scheme preference, and fingerprints screen size and operating system through the media and font-face at-rules and unique resource URLs.
Why it matters: Each recipient in these campaigns was assigned a unique identifier embedded in tracking URLs, and appended tracking pixels collected IP addresses, email clients, and device details - so an email that looks like a benign marketing message can map your users' systems and confirm which messages were opened and printed.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026