Hackers Exploit CSS Properties to Conceal Malicious Code in Hidden Text Salting Attacks
## Email Threat Mitigation Using CSS Techniques
Email Threat Mitigation Using CSS Techniques
Recent advancements in email-based attacks have seen the use of Cascading Style Sheets (CSS) to introduce hidden "salt" – irrelevant content designed to bypass detection systems – within HTML emails.
According to Cisco Talos's monitoring from March 1, 2024, to July 31, 2025, there has been a significant increase in the exploitation of CSS properties to obscure malicious code, complicating both signature-based and machine learning-driven defenses. Attackers embed hidden text salts in strategic email components to evade filters, manipulate language detection, and distort intent analysis.
Initially, threat actors inserted random characters between keywords to bypass signature scanners. This approach evolved with the use of CSS properties such as font-size:0 or opacity:0 to render the salt invisible to users while detectable by parsers.
By incorporating irrelevant French terms within English text, attackers have misled language detection systems, allowing phishing emails to bypass filters. For instance, a PayPal-impersonating scam concealed the sentence "Great news, we’ve got your order" within a <div> styled with font-size:1px and line-height:0 , becoming visible only when the font size increased to 20px.
Similarly, Harbor Freight phishing emails used hidden French salt via display:none , affecting the X-Forefront-Antispam-Report language field.
Cisco Talos categorizes CSS misuse for hidden text salting into three content types: random characters, irrelevant paragraphs, and HTML/JavaScript comments. Salts appear in four main email regions: preheader, header, attachments, and body.
Attackers embed hidden text salts in strategic email components to evade filters, manipulate language detection, and distort intent analysis.
Common techniques include using zero-width spaces (ZWSP) or non-joiners (ZWNJ) between brand names, as seen in Norton LifeLock impersonations. Attachments often carry salts in HTML, with random comments around Base64 data. The body is frequently targeted with raw keywords interspersed with junk characters.
CSS property categories manipulated include:
Text properties ( font-size , color , line-height ) Visibility and display properties ( display:none , visibility:hidden ) Clipping and sizing ( width:0 , overflow:hidden )
In a Wells Fargo phishing example, meaningful keywords were salted using a global bdo selector with font-size:0 , altering the intent classification of defenses.
To counter these tactics, defenders must adopt a dual approach encompassing detection and filtering. Detection solutions should analyze CSS usage patterns and visual discrepancies. Advanced filters can inspect email components to identify and flag hidden content. Visual-based analysis, such as rendering email snapshots, can help detect invisible overlays.
Organizations should adjust policies to tolerate legitimate uses while flagging abnormal CSS payloads. AI-driven, deep-learning models that account for visual, structural, and contextual features can enhance resilience against these tactics.
Filtering solutions should sanitize HTML upon ingestion, removing or escaping invisible elements before further processing. Email gateways can be configured to ignore content styled as hidden.
Continuous monitoring of CSS misuse, alongside proactive sanitization, is crucial in mitigating this emerging threat.
Based on reporting by GBHackers.