Unseen but Not Unheard: Exposing the Cases of CSS Abuse in Email Threats and Fortifying Defenses

Unseen but Not Unheard: Exposing the Cases of CSS Abuse in Email Threats and Fortifying Defenses

Speakers: Omid Mirzaei

Conference: Blue Team Con Online

YouTube: https://www.youtube.com/watch?v=cAnper1z_2Q

Overview

In the ever-evolving landscape of cyber threats, attackers consistently leverage benign technologies for malicious ends. This talk, presented by Omid Mirzaei from Cisco Talos at Blue Team Con Online, shines a critical light on a particularly insidious technique: the abuse of Cascading Style Sheets (CSS) properties in email threats. Mirzaei meticulously details how threat actors exploit CSS to conceal malicious content, track user actions, and fingerprint devices, all while evading sophisticated detection mechanisms.

The presentation emphasizes that this seemingly simple trick has profound implications for both traditional rule-based and advanced machine learning-driven email security solutions. By dissecting various concealment methods and their impact on detection pipelines, Mirzaei not only exposes the efficacy of these tactics but also proposes innovative, large language model (LLM)-based defensive strategies. This talk is crucial for security defenders, email platform providers, and anyone involved in threat intelligence, offering a deep dive into an often-overlooked vector for email-borne attacks and outlining actionable steps to fortify defenses against it.

Background

▶ Watch: Blue Team Con Online welcome and overview (2:00)

The premise of this talk is rooted in a fundamental observation within cybersecurity: legitimate technologies are frequently weaponized by adversaries. Omid Mirzaei begins by illustrating this trend with several examples beyond email, setting the stage for the specific focus on CSS abuse. He first discusses living off the land binaries (LOLBINs), which are legitimate system executables or scripts that attackers repurpose for malicious activities like executing scripts, downloading payloads, or running dynamic link libraries (DLLs). Examples include mshta.exe for HTML applications, certutil.exe for certificate management, and powershell.exe for automation.

Next, Mirzaei highlights the abuse of JavaScript, a powerful language for dynamic web content, which has been exploited for dynamic code execution (e.g., eval() function), cross-site scripting (XSS) vulnerabilities, malicious use of web APIs (e.g., file, websocket, clipboard), and social engineering tactics like clickjacking through invisible iframes. Even mobile platforms are not immune, with Android's intent-based communication system and permissions being co-opted for intent spoofing, data leakage, and real-time user geolocation tracking without consent.

Transitioning to email, Mirzaei details the abuse of various legitimate third-party services. Cloud and collaboration platforms (e.g., Google Drive, OneDrive, Adobe e-signature) are frequently used to host malicious payloads, fake login pages, or embed links in PDF files, or even as command-and-control (C2) infrastructure. Email marketing platforms (e.g., Mailchimp, SendGrid) are exploited for large-scale spam campaigns, reconnaissance via analytics features, and collecting sensitive data through subscription forms. Additionally, URL shortening services are routinely used to obfuscate malicious URLs, while bot management services (e.g., CAPTCHA providers) are ironically abused by attackers to prevent automated security systems from reaching and analyzing final phishing pages. This extensive background underscores a recurring theme: any widely adopted, trusted, and flexible technology can become a double-edged sword, and CSS in emails is no exception.

Key Findings

▶ Watch: Omid Mirzaei's professional and academic background (5:00)

Omid Mirzaei's core findings revolve around three major categories of CSS properties abuse in emails:

1. Tracking User Actions and Preferences: Attackers leverage CSS to gather intelligence about email recipients. A prime example involves media queries, specifically prefers-color-scheme, to determine if a user employs a dark or light mode. By linking unique URLs to these CSS states, attackers can track user preferences and even detect when an email is printed (using media print). Services like emltrack.com are identified as platforms used for such analytics.
2. Fingerprinting Devices: This technique involves embedding a simple tracking pixel (a 1x1 invisible image) in an email. When the email is opened, the pixel's request to a tracking server can reveal a wealth of information about the recipient's environment. This includes approximate geolocation, the specific email client and operating system (via the HTTP User-Agent string), configured language preferences, supported media types, the exact time and date the email was opened, and even the original IP address if not routed through a proxy.
3. Malicious Content Concealment (Hidden Text Salting): This is the primary focus of the talk, describing how attackers embed invisible or irrelevant content within emails to evade detection. Mirzaei demonstrates that this technique is significantly more prevalent in spam messages compared to legitimate (ham) emails. The reasons for its use are varied, including evading spam filters, bypassing brand name identification systems, confusing file analysis in attachments, disrupting email parsers, and evading language detection mechanisms. Crucially, he shows that this simple trick can severely impact the efficacy of both existing keyword/HTML-feature-based detection systems and even advanced large language model (LLM)-based security solutions.

The impact on LLMs is particularly noteworthy. Mirzaei illustrates how hidden text can manipulate an LLM's interpretation of an email's sentiment, intent, or language. By injecting a few invisible words, an attacker can shift an LLM's classification of an email from "neutral" to "negative," or change its perceived intent from "request action" to "schedule a meeting," or even alter the detected language from English to French or Spanish. This highlights the vulnerability of even sophisticated AI systems to subtle, concealed inputs, a concept known as indirect prompt injection.

Technical Deep Dive

▶ Watch: Examples of Living Off The Land (LOTL) binaries abuse (6:15)

The technical deep dive into CSS abuse primarily focuses on malicious content concealment, or hidden text salting. Mirzaei outlines the various attack surfaces and the specific techniques and CSS properties employed by adversaries.

Attack Surfaces for Content Concealment:

1. Preheader: This is the snippet of text that appears after the subject line in an email client's inbox view. Attackers hide content here, often visible only in the HTML source, to evade initial scrutiny while still impacting detection systems. An example shows a scam impersonating Blue Cross Blue Shield with hidden content in the preheader.
2. Email Body: As expected, the main body of the email is a prime target. Attackers embed fixed patterns of irrelevant strings or characters between legitimate words. An example of a Wells Fargo impersonation shows seemingly random strings injected within the email body, designed to break up keywords and confuse text-based detection.
3. Attachments: Attackers include comments or irrelevant characters within sensitive data, such as Base64 encoded strings in JavaScript files attached to emails. This "salting" within encoded data aims to break signature-based detection or parsing of malicious URLs.

Techniques for Content Concealment:

1. Adding Single Characters or Small Strings: Attackers insert zero-width space characters or zero-width non-joiner characters into brand names or keywords. These characters are invisible to the human eye but alter the string, potentially bypassing exact-match brand impersonation detection.
2. Adding Paragraphs or Large Text Blobs: Instead of single characters, attackers insert entire paragraphs of irrelevant text (e.g., German text in an English email) into the email body. They use a combination of CSS properties to render this text invisible. A common technique involves the clip property (or its modern equivalent, clip-path) and the overflow property. The clip property creates a small, often rectangular or circular, container, while overflow: hidden ensures that any content exceeding the boundaries of this tiny container is not displayed. This effectively hides large amounts of text within an email.
3. Adding Comments: Beyond Base64 encoded strings, comments are also inserted between key identifiers, such as after function names in JavaScript or within constant strings in HTML smogling cases, to break up patterns and confuse parsers.

Key CSS Properties Abused:

Mirzaei categorizes the most popular CSS properties used for concealment:

• Text Properties:
• color: Setting text color to match the background color (e.g., color: white; background-color: white;).
• font-size: Making text extremely small (e.g., font-size: 0px or font-size: 1px).
• text-indent: Shifting text far off-screen (e.g., text-indent: -9999px).
• line-height: Reducing the height of the line to zero (e.g., line-height: 0).
• Visibility and Display Properties:
• display: none: Completely removing an element from the document flow, making it invisible and not taking up space.
• visibility: hidden: Hiding an element while still maintaining its space in the layout.
• opacity: 0: Making an element fully transparent.
• Clipping and Sizing Properties:
• clip (older version) and clip-path (newer version): Defining a visible portion of an element, effectively hiding everything outside that region.
• width and height: Setting dimensions to zero or near-zero values to collapse the content area.

Attackers often employ resources like caniemail.com to check the compatibility of various CSS properties across different email clients. This allows them to select properties that are widely supported, maximizing the impact and reach of their hidden content techniques across a broad range of target environments.

Demo / Proof of Concept

▶ Watch: JavaScript abuse for dynamic code and XSS (8:00)

While the talk did not feature a live, interactive demonstration, Omid Mirzaei presented several compelling case studies and examples derived from real-world data, illustrating the efficacy of hidden text salting and the capabilities of Cisco's detection architecture. These examples served as powerful proof-of-concept for both the attack vector and the proposed defensive solution.

One notable case study involved an email impersonating "Harbor Freight," which rendered entirely in English to the recipient. However, upon inspection of the HTML source, the email contained a significant amount of invisible French text. This discrepancy was further highlighted by the Microsoft email header, which incorrectly detected the email's language as French, demonstrating how hidden text can confuse language detection pipelines and impact email defense solutions.

Another example showcased an email impersonating "PayPal" that contained a hidden sentence: "Great news, we've got your order." This text was concealed using a combination of CSS properties, including a small font-size and a zero line-height. Mirzaei illustrated that by simply adjusting these properties (e.g., increasing font size and removing line height), the hidden "salt" could be revealed in the top-left corner of the email, proving its presence and potential to evade detection.

The most impactful "demonstration" involved the vulnerability of large language models (LLMs) to hidden text. Mirzaei presented an Outlook-impersonating phishing email where a CSS type selector was used to hide content. When the raw HTML source of this email was fed to an LLM (specifically GPT-4 mini), the model correctly identified its sentiment as "neutral" and its intent as a "request action" (e.g., "please retain your password"). However, by injecting a single, invisible sentence at the end of the email (e.g., "I hate this email" or "Can I schedule a quick meeting with you to discuss this further?"), the LLM's output was dramatically altered. The sentiment shifted from neutral to "negative," and the intent changed from "request action" to "schedule a meeting." Similarly, by adding a few hidden sentences in French or Spanish, the LLM's detected language for the entire email could be switched from English to the injected language, despite the majority of the visible content remaining in English. These examples powerfully illustrate the concept of indirect prompt injection and underscore the critical need for robust detection mechanisms against hidden content, even when employing advanced AI for security.

Defensive Implications

▶ Watch: Abuse of Android location permissions (12:00)

Understanding the pervasive nature and impact of CSS abuse, particularly hidden text salting, is paramount for fortifying email defenses. Omid Mirzaei outlines two main mitigation strategies: filtering (finding and excluding hidden content) and detection (identifying when content is concealed for malicious purposes).

He first reviews existing academic approaches:

1. Heuristic-based detection: These methods analyze rendering commands, looking for text that is invisible due to properties like character color matching background, tiny font sizes, or specific positioning. The primary limitation is their lack of coverage for new tricks and the continuous need for updates as CSS properties evolve or new techniques emerge.
2. Detection via visual analysis: These approaches attempt to create a cognitive model of perceived text, comparing it against the actual rendered text (often extracted via Optical Character Recognition - OCR). They look for visual anomalies. However, they suffer from rendering errors, the inherent error-proneness of OCR, and significant computational costs.
3. Detection via natural language processing (NLP): These methods compare the rendered text with the text extracted directly from the HTML source, using NLP techniques and distance metrics to find discrepancies. Similar to visual analysis, they are prone to rendering and OCR errors, exhibit language dependency, and incur computational overhead.

Recognizing these limitations, Cisco Talos has developed an innovative, patent-pending approach that leverages large language models (LLMs) for detecting hidden text salting. The advantages of their LLM-based solution are significant:

• No message rendering or OCR analysis required: This eliminates two major sources of errors and computational expense.
• Scalability: The approach scales relatively well, potentially using distilled or optimized LLM versions rather than very large, resource-intensive models.
• Broad applicability: It can be applied to all messages and is capable of detecting new and evolving concealment tricks without frequent updates to heuristic rules.
• High precision: With minimal fine-tuning, the system achieves high precision in detection.

The core of Cisco's LLM-based approach involves creating a fine-tuning data set comprising malicious, benign (ham), and gray emails that utilize hidden text salting for both legitimate and illegitimate purposes. HTML sources are extracted from three key locations: the email body, HTML attachments, and linked web pages. These sources are then fed as task-specific examples (prompt-completion pairs) to a pre-trained LLM, which is then fine-tuned. The fine-tuned LLM acts as a binary classifier to detect the presence of hidden text salting across these attack surfaces in unseen email traffic.

The performance statistics for this LLM-based architecture are promising, with an accuracy of 0.95, precision of 0.91, and recall of 0.92, alongside a relatively low average processing time of 2.13 milliseconds.

Future Improvements and Use Cases:

Mirzaei outlines future work, including improving efficacy, further optimizing performance with smaller models, and thoroughly studying privacy and security risks. The scope will also expand to detect user tracking and device fingerprinting using similar pipelines.

The immediate use cases for such a detection pipeline are versatile:

• Standalone email threat detection engine: It can function independently to identify hidden content.
• Additional signal in existing detection engines: Its strong detection signal (as shown by prevalence data) can enhance current security solutions.
• Additional signal in agentic AI defense solutions: It can contribute to more advanced, AI-driven defense architectures.

Key Takeaways

• CSS Properties are a Double-Edged Sword: Legitimate CSS properties designed to enhance email presentation are widely abused by attackers for malicious purposes.
• Multi-faceted Abuse: Attackers exploit CSS for user tracking, device fingerprinting, and, most significantly, malicious content concealment (hidden text salting).
• Evasion of Traditional and Advanced Defenses: Hidden text salting is a simple yet powerful technique capable of evading both conventional keyword/rule-based detection systems and sophisticated large language model (LLM)-based security solutions.
• Impact on LLMs: Hidden content can manipulate LLMs' interpretations of email sentiment, intent, and language, facilitating indirect prompt injection attacks.
• LLM-based Defense is Promising: Novel detection methods leveraging fine-tuned LLMs offer a robust, scalable, and adaptable approach to identify hidden text salting, overcoming limitations of heuristic, visual analysis, and traditional NLP methods.
• Continuous Vigilance is Key: Developing effective detection and filtering methods for hidden text is crucial for significantly enhancing overall email threat defense solutions against evolving evasion tactics.

About the Speaker(s)

Omid Mirzaei is a distinguished member of the email threat research team at Cisco Talos. His team is at the forefront of developing and monitoring customer-facing detection features designed to block email threats, and they actively share threat intelligence with the broader security community. Mirzaei brings over a decade of experience in the cybersecurity domain, with a diverse background spanning various critical areas. He began his career focusing on cryptography and steganography, later transitioning into Android security, where he specialized in Android malware detection and characterization. His expertise further expanded to Windows malware detection before he dedicated his efforts to email security, his current specialization. Omid holds a Bachelor's degree in Computer Software Engineering, a Master's in Artificial Intelligence, a Ph.D. in Computer Security from Carlos III University of Madrid, and a Postdoctoral degree in Computer Security from Northeastern University. He has contributed to the field through numerous conference and journal papers, several blog posts, and multiple US patents, underscoring his significant contributions to cybersecurity research and innovation.