CSS Email Attacks Let Hackers Steal Passwords, Tokens and Hijack AI Browsers

A newly disclosed vulnerability reveals that seemingly innocuous CSS embedded in emails can be exploited to steal login credentials, hijack authentication tokens, and manipulate AI-powered browsers, all while bypassing webmail providers' security measures This article explores text security. . This vulnerability allows hackers to steal passwords by manipulating how users interact with their email interfaces.

Using pure CSS attribute selectors combined with nested selectors, Heyes demonstrated brute-forcing twelve-character hex authentication tokens, including a real login token belonging to Medium.com, by triggering background-image requests that leaked data character by character. Even when Content Security Policy blocked all external resources, he built a font-height oracle using font-face rules, unicode-range, and CSS animations to measure digit frequency and exfiltrate numeric tokens purely through link clicks, with no scripting required.

Combined with `` and `` fields styled to mimic password fields using `webkit-text-security`, along with a Firefox timing quirk that resets input delays when elements move off screen, he constructed a fully functional real-time keylogger capable of spoofing an authentic Microsoft login interface within an email, all while circumventing DOMPurify filtering. Heyes recommends isolating email content in sandboxed iframes, blocking data URLs and select menus in HTML sanitizers, disallowing risky CSS pseudo-classes like has, checked, and focus, enforcing strict character allow-lists to prevent CSSOM mutation, and mandating image proxies for all remote resource requests to limit tracking and exfiltration.

Trending News

Shell Investigating Data Breach Following Cl0p Ransomware Group Claim

|CYBER ATTACK|Zerowl

Shell Investigating Data Breach Following Cl0p Ransomware Group Claim

Red Hat ACM Flaw Lets Namespace Editors Escalate to Full Kubernetes Cluster Admin

|CYBER ATTACK|Zerowl

Red Hat ACM Flaw Lets Namespace Editors Escalate to Full Kubernetes Cluster Admin

Post-Hugging Face Reflections: The Agentic Attacker Is Already Here

|CYBER ATTACK|Zerowl

Post-Hugging Face Reflections: The Agentic Attacker Is Already Here

New Ruby RCE Gadget Chain Turns Unsafe Marshal.load Into Command Execution

|CYBER ATTACK|Zerowl

New Ruby RCE Gadget Chain Turns Unsafe Marshal.load Into Command Execution

New DRAM Scrambling Attack Exposes CPU’s Most Protected Memory Zones

|CYBER ATTACK|Zerowl

New DRAM Scrambling Attack Exposes CPU’s Most Protected Memory Zones

Microsoft Updates Copilot App, Merges Personal Chats and Retires Key AI Features

|CYBER ATTACK|Zerowl

Microsoft Updates Copilot App, Merges Personal Chats and Retires Key AI Features

Microsoft Entra ID to Retire SMS and Voice MFA as Passkeys Become Default

|CYBER ATTACK|Zerowl

Microsoft Entra ID to Retire SMS and Voice MFA as Passkeys Become Default

Malware Crypter Services Sell Windows Defender, EDR and SmartScreen Bypasses to Cybercriminals

|CYBER ATTACK|Zerowl

Malware Crypter Services Sell Windows Defender, EDR and SmartScreen Bypasses to Cybercriminals

Hackers Using New Blackhat AI Tool MessiahGPT to Generate Ransomware and Phishing Kits

|CYBER ATTACK|Zerowl

Hackers Using New Blackhat AI Tool MessiahGPT to Generate Ransomware and Phishing Kits

Hackers Started to Exploit Critical SAP Commerce Cloud, Still No Public PoC

|CYBER ATTACK|Zerowl

Hackers Started to Exploit Critical SAP Commerce Cloud, Still No Public PoC