CSS Bomb Attacks Turn Malicious Emails Into Password-Stealing Keyloggers

A new class of email-based attacks that exploit ordinary CSS styling code to hijack webmail interfaces, spy on user activity, and even steal passwords in real time, all without relying on JavaScript or traditional malware. Dubbed “CSS bomb” attacks, the technique weaponizes trusted formatting features found in nearly every major webmail platform, turning a routine HTML email into a stealth keylogger capable of capturing credentials as victims type them. The PortSwigger researcher Gareth Heyes examined how webmail clients such as Gmail, Outlook, Yahoo Mail, AOL Mail, Fastmail, and ProtonMail sanitize incoming HTML and CSS before rendering it. These sanitizers are meant to strip out dangerous code while still allowing...

Read the full article at the source.