Research shows attackers can weaponize CSS inside HTML emails to reach beyond the message area in some webmail clients, enabling UI spoofing, token/session theft, and even near real-time capture of what a victim types. The same CSS-based tricks can also manipulate AI email assistants connected to inboxes, turning “summarize my inbox” into unintended data exposure.
Research from PortSwigger demonstrated that plain CSS embedded in HTML emails can be used to steal passwords, hijack sessions, and manipulate AI tools reading your inbox. The attack paths fall into two categories: abusing CSS features that webmail clients already permit, and exploiting mismatches between what sanitizers approve and what browsers actually render. In one Outlook example, a CSS gadget broke the boundary between an untrusted email and the trusted webmail UI, allowing a dropdown menu to be disguised as a password field that captured whatever the victim typed in something close to real time.
These techniques succeeded because CSS features like position:fixed allow an element to be placed anywhere on the page, breaking the trust boundary that is supposed to separate email content from the surrounding mailbox interface. In a Yahoo/AOL scenario, a copy/paste gap in Firefox drafts briefly preserved active styling long enough to leak a 12 character email-login token used to sign in as the victim. The sanitizers approved certain CSS, but browsers rendered it differently than expected, creating a gap attackers could exploit.
The same tricks extend to AI tools connected to inboxes. In a Gmail example, a CSS image-set() fallback triggered external requests despite sanitization and was chained into an indirect prompt-injection email processed through a connected Gmail integration. The injected instructions caused the AI assistant to retrieve a token and place it in an HTML draft, and viewing that draft leaked it. In another case involving OpenAI Atlas, hidden CSS pseudo-elements showed humans harmless content while an AI model read a completely different, hidden instruction underneath, turning a normal inbox summarization request into unintended data exposure.
Treat any in-email credential prompt as suspicious and only enter passwords on a sign-in page you navigate to yourself. Avoid following copy/paste instructions in webmail drafts, especially involving HTML or styled content, since this can leak tokens or session data. For teams using AI copilots connected to email, assume that any message could contain hidden instructions meant for the AI rather than the human reader, and avoid letting these tools auto-act on inbox content without a review step.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
CSS can be used to spoof UI elements inside webmail, such as disguising a dropdown menu as a password field, so that whatever the victim types is captured in something close to real time.
Yes, hidden CSS can show a human harmless text while an AI model reads a completely different, hidden instruction underneath, leading to indirect prompt injection when the assistant processes the email.
In Firefox, HTML pasted into a draft can briefly keep its active styling before sanitization strips it out, which researchers showed could be exploited to leak a 12 character login token.
Be suspicious of any password prompt appearing inside an email body, avoid following copy/paste instructions involving formatted content, and review AI assistant actions rather than letting them auto-act on inbox content.
Imagine an email that can steal your password without a single link click. PortSwigger showed that plain CSS in HTML emails can break out of the message window, spoof Outlook’s UI, and capture whatever you type almost in real time. One demo even disguised a dropdown menu as a password field to hijack your session. Same trick hits tokens and even AI. In Yahoo and AOL, styled content pasted into a draft in Firefox briefly keeps active CSS long enough to leak a 12‑character login token. In Gmail, a CSS image-set fallback was chained into an indirect prompt injection against an AI assistant, exposing data from an HTML draft. Here’s the rule: if a password box or verification step appears inside an email, no matter how real it looks, stop. Close it, and sign in by opening your webmail or app yourself, never through the email’s UI.
PortSwigger research shows how attackers can weaponize HTML/CSS inside emails to cross trust boundaries in webmail, including UI manipulation, token theft, and password theft. The paper highlights real-world weaknesses in email sanitization and gives concrete examples (including an Outlook…
Zenity demonstrated real-world attack chains where hidden instructions in emails or content on X can hijack AI “agentic browsers” (ChatGPT Atlas and the Claude Chrome extension). In the demos, the AI agent can be steered to perform actions in the user’s already logged-in sessions, sending phishing…
Researchers showed how a malicious web page could trick OpenAI’s Atlas AI-enabled browser into taking actions a user didn’t intend, like spamming WhatsApp contacts or modifying an Amazon account. The attacks used prompt-injection style instructions hidden in a seemingly legitimate “newsletter…
The article reports real-world social engineering operations, including a hotel Wi‑Fi campaign that pushed fake updates and device-code phishing to steal Microsoft 365 access. It also describes an alleged Microsoft Entra vishing campaign tied to data theft claims at Brinks Home, reinforcing the…
A Russia-linked threat group compromised hotel WiFi captive portals to redirect guests to fake “verification” pages. Victims were pushed toward either copying commands into a terminal to install malware or entering Microsoft credentials on spoofed login pages that added an attacker-controlled…
Microsoft says attackers hijacked captive portals on hotel and conference Wi‑Fi to redirect travelers through attacker infrastructure. Victims were shown fake browser/OS update prompts (and sometimes “paste-and-run” instructions) to install malware, and later were pushed into Microsoft device-code…
