Cybercriminals Harness CSS to Outsmart Filters and Monitor Emails

Summary

• Rising Threat: Attackers are abusing Cascading Style Sheets (CSS) in emails to slip past spam filters and track recipients.
• Methodology: Hidden text and CSS tricks confuse filters, while CSS rules can reveal details about the reader’s email client.
• Industry Impact: The technique makes phishing harder to catch and raises privacy concerns.
• Preventive Measures: Better email filtering and user training help limit the risk.

Introduction

Cisco Talos researchers reported in March 2025 that attackers are abusing Cascading Style Sheets (CSS), the code that controls how emails and web pages look, to sneak spam and phishing past email filters. The same tricks can track who opens a message and what software they use. It is a simple idea. It works.

CSS: A New Vector for Cyber Attacks

CSS is meant for layout and design. Attackers use it to hide things. Talos described “hidden text salting,” where an email is stuffed with invisible text, set to zero size or hidden from view, that changes how a filter reads the message while the human reader sees only the scam.

CSS can also be used for tracking. Some CSS rules load a resource only under certain conditions, such as a particular screen size or email client, so the sender learns when a message was opened and details about the recipient’s setup. That helps attackers confirm live addresses and tailor future attacks.

Why Phishers Like It

Phishing is old, but CSS tricks give it new life. Because the hidden content sits inside the formatting, the visible email looks normal to the person reading it. Filters that rely on reading the text can be fooled into scoring it as harmless.

Why Filters Struggle

Many filters focus on suspicious links, attachments and keywords. CSS salting does not need any of those to work. It manipulates what the filter sees, not what the reader sees.

Email security vendors are adjusting by looking at how content is hidden and by rendering messages the way a mail client would. Talos recommended filters that detect hidden text and that look at visual rendering, not just the raw text.

Countermeasures and Best Practices

Use email security tools that inspect HTML and CSS for hidden content. Disabling remote content loading in email clients also cuts off much of the tracking.

Training still helps. Staff who know phishing emails can look perfectly clean are more likely to check before clicking. No filter catches everything.

What Comes Next

CSS abuse is a reminder that attackers keep finding new uses for ordinary tools. The fix is not exotic. It takes filters that look at emails the way people see them, mail clients that block remote content by default and staff who stay skeptical.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.