Security News > 2024 > April > Security Vulnerability of HTML Emails

The email your manager received and forwarded to you was something completely innocent, such as a potential customer asking a few questions.

The innocent pretext disappeared and the real phishing email became visible.

A phishing email you had to trust because you knew the sender and they even confirmed that they had forwarded it to you.

This attack is possible because most email clients allow CSS to be used to style HTML emails.

When an email is forwarded, the position of the original email in the DOM usually changes, allowing for CSS rules to be selectively applied only when an email has been forwarded.

An attacker can use this to include elements in the email that appear or disappear depending on the context in which the email is viewed.

News URL

https://www.schneier.com/blog/archives/2024/04/security-vulnerability-of-html-emails.html