Outlook Users Targeted by New HTML-Based Phishing Scheme
Recent investigations have uncovered a sophisticated phishing technique exploiting Microsoft Outlook's handling of HTML emails to conceal malicious links from corporate users.
Recent investigations have uncovered a sophisticated phishing technique exploiting Microsoft Outlook's handling of HTML emails to conceal malicious links from corporate users.
The attack, initially appearing as a phishing attempt impersonating a Czech bank, uses conditional HTML comments to display different content based on the email client. This method allows attackers to display a legitimate bank URL to Outlook users while redirecting others to a credential-harvesting site.
The core of this evasion technique relies on Microsoft's proprietary conditional comments, known as "MSO conditional tags." These tags allow developers to target specific versions of Outlook by wrapping HTML code in special comments that only Outlook recognizes.
<!--[if mso]> <a href="https://benign-bank.com">Update Your Info</a> <![endif]--> <!--[if !mso]><!--> <a href="https://malicious-phish.com">Update Your Info</a> <!--<![endif]-->
<!--[if mso]> ... <![endif]--> : Content inside this block is rendered only by Outlook. <!--[if !mso]><!--> ... <!--<![endif]--> : Content inside this block is rendered by all clients except Outlook.
In this phishing campaign, attackers use these conditional statements to ensure that security teams using Outlook see only the legitimate link, while others see the malicious link, increasing the likelihood of credential theft.
This method allows attackers to display a legitimate bank URL to Outlook users while redirecting others to a credential-harvesting site.
How Different Email Clients Render the Phishing Email
Email Client Displayed Link Rendered Code Block
Outlook (Desktop) https://benign-bank.com <!--[if mso]>
Gmail/Thunderbird https://malicious-phish.com <!--[if !mso]><!-->
Security Implications and Mitigation Strategies
This technique is particularly dangerous as it can bypass many traditional email security gateways that often ignore content inside HTML comments. Outlook's conditional comments are an exception, allowing the malicious payload to evade security filters.
Deploy advanced Email Security Gateways capable of parsing and neutralizing MSO conditional comments. Train users to be cautious of emails urging immediate action, especially those requesting sensitive information, even if the link appears legitimate in Outlook. Use sandboxing tools that open suspicious emails in multiple clients to reveal hidden malicious content.
if "<!--[if mso]>" in email_html and "<!--[if !mso]><!-->" in email_html: flag_as_suspicious(email)
The use of Outlook's conditional comments for phishing, although not new, remains rare and underreported. This method highlights the need for security teams to understand HTML rendering across platforms. Staying informed and updating defenses are crucial in protecting against sophisticated phishing campaigns.
Based on reporting by GBHackers.