Loading story…
Researchers disclosed a set of HTML/CSS-only attack chains that let malicious emails break out of normal message boundaries in major webmail clients, enabling password capture, token leakage, UI action hijacking, and even keylogging-like behavior without JavaScript or attachments. The findings, presented by PortSwigger's Gareth Heyes, showed that modern CSS features can be abused to interfere with trusted interface elements in services including Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail, turning routine email rendering into a path for account takeover and data exfiltration.
The research said some flaws were fixed after disclosure, including two CSS mutation bugs in Fastmail and a Proton Mail proxy bypass that no longer worked on retest, while Outlook label-jacking and Gmail image-set()-based bypasses still worked when the paper was published. Researchers said they found no evidence of active exploitation, but public proof-of-concept techniques remained available, and they urged vendors to isolate HTML email in sandboxed iframes, strengthen sanitization, and more tightly restrict CSS, custom attributes, select menus, and image requests because end users have little practical ability to disable CSS in webmail.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
As of August 8, public proof-of-concept code for the disclosed CSS-based webmail techniques was still available. The research continued to state that it had found no evidence of malicious exploitation.
When the research was published on August 6, PortSwigger said Outlook label-jacking and Gmail's image-set() bypass still worked. These remaining issues showed that some attack chains were still reproducible at publication time.
PortSwigger published research describing multiple HTML/CSS proof-of-concept attack chains against major webmail services, including Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail. The paper said it found no evidence of malicious exploitation, but documented impacts such as password capture, token leakage, UI hijacking, and AI-tool manipulation.
Gareth Heyes presented the CSS-based webmail attack research at Black Hat USA 2026. The presentation detailed how HTML and CSS in emails could escape message boundaries and interfere with trusted webmail interface elements.
The research reported that a Proton Mail proxy-bypass technique no longer worked when retested, indicating the issue had been remediated or otherwise closed. A separate Proton Mail vector exposing the recipient IP address was also described in the research.
PortSwigger's research said Fastmail fixed two CSS mutation bugs identified in the webmail attack research. These fixes were in place by the time the research was publicly discussed.
Gareth Heyes reported flaws, hijacking bugs, and advanced CSS-based attack methods affecting major webmail platforms to vendors. According to the reporting, vendor responses varied, with some responding transparently and others later fixing issues quietly.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourceportswigger.net
Open sourcedarkreading.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are increasingly leveraging cascading style sheets (CSS) to insert hidden text and irrelevant content into emails, a tactic known as hidden text salting, to evade detection by email security solutions. Cisco Talos has been monitoring this trend for over a year, observing a significant rise in the use of CSS-based hidden content in both spam and malicious emails. The technique involves embedding random characters, nonsense paragraphs, and hidden comments within various parts of an email, such as the preheader, header, attachments, and body. These elements are manipulated using CSS properties that control text visibility and sizing, making the added content invisible to the recipient but confusing to automated detection systems. This method is particularly effective at bypassing both traditional spam filters and advanced machine learning-based email defenses, as it introduces noise that can disrupt keyword-based and pattern-matching algorithms. Cisco Talos has reported on this tactic multiple times throughout 2025, noting a steady increase in its adoption by threat actors. The abuse of CSS for hidden text salting is not limited to a single campaign but is widespread across various email threats, making it a substantial challenge for enterprise security teams. Researchers highlight that while CSS is a legitimate tool for enhancing email appearance and branding, its misuse for content concealment is now a common feature in malicious campaigns. The prevalence of hidden text salting in spam and phishing emails far exceeds its occurrence in legitimate communications, underscoring its role as a deliberate evasion strategy. Security experts warn that this technique can also impact the effectiveness of large language model (LLM)-based defense solutions, which may be particularly susceptible to poisoned or noisy input. The ongoing evolution of this tactic demonstrates the adaptability of threat actors in circumventing security controls. Cisco Talos has shared key findings with the security community to raise awareness and encourage the development of more robust detection mechanisms. The research emphasizes the need for email security solutions to account for hidden and obfuscated content, not just visible text. Organizations are advised to review their email filtering rules and consider enhancements that can detect and neutralize hidden text salting. The continued monitoring and reporting by Cisco Talos provide valuable intelligence for defenders seeking to stay ahead of these evolving email-based threats.
Jun 29, 2026
Russia-aligned espionage groups **TA458** and **TA488** have been exploiting vulnerabilities in webmail platforms including **Roundcube, Zimbra, SOGo, mDaemon, Kerio,** and **SOGo** to compromise government and defense targets through so-called **"half-click"** attacks, where opening a malicious email in a webmail session triggers attacker-controlled JavaScript. Proofpoint reported TA458 used a **SOGo zero-day** later patched as `CVE-2026-8496`, while TA488 exploited a previously unknown **Zimbra** flaw assigned `CVE-2025-66376` for months. The campaigns targeted Ukrainian government entities, Eastern European military and government organizations, and parts of the U.S. defense industrial base and nuclear sector, with malware such as **SpyPress** and **ZimReaper** stealing credentials, contacts, emails, CSRF tokens, and app-specific passwords to bypass multifactor protections. Reporting on **APT28** infrastructure exposed in early 2026 tied the broader **Operation RoundPress** activity to a larger webmail espionage program that relied heavily on patched but unremediated flaws, including `CVE-2020-35730`, `CVE-2023-43770`, `CVE-2021-44026`, and `CVE-2020-12641` in Roundcube. Researchers said the leaked toolkit included XSS payloads, a Flask-based command-and-control server, a Go implant for GNU/Linux, operator bash history, and victim data, revealing poor operational security and overlap between staging, exfiltration, and pivot infrastructure. TA458 was also observed chaining a Roundcube XSS vector with `CVE-2025-49113` to achieve PHP deserialization and arbitrary code execution, showing that the actors are pursuing not only mailbox theft and forwarding-rule abuse but also persistent server-side access.
Aug 2, 2026
Multiple severe vulnerabilities in **SmarterMail** exposed internet-facing mail servers to compromise, including `CVE-2025-52691`, an unauthenticated arbitrary file upload flaw that can lead to immediate remote code execution, and `CVE-2026-23760`, an authentication bypass tied to the password reset API. Public reporting said `CVE-2025-52691` affected **Build 9406 and earlier**, carried a **CVSS 10.0** rating, and allowed attackers with network access to place files in arbitrary server locations and execute code with the privileges of the SmarterMail service. Advisories from Censys highlighted both issues, while a public GitHub proof-of-concept for `CVE-2026-23760` increased the risk of opportunistic exploitation. SmarterTools reportedly fixed the file upload vulnerability in **Build 9413**, with later builds available afterward, and security reporting warned that successful compromise of a mail gateway could expose customer email, credentials, and connected backend systems. The flaws were described as especially dangerous for hosting providers and organizations running exposed SmarterMail instances because they enable unauthenticated access paths that can quickly escalate to full server compromise.
Jun 29, 2026