Recent research by cybersecurity experts has uncovered a vulnerability in Microsoft 365's anti-phishing mechanisms, which can be exploited using CSS. This flaw allows attackers to bypass safety alerts ...

using CSS style tags. Because the First Contact Safety Tip is added to the HTML code of an email before the message content, all a phisher would have to do is craft an email solely in HTML ...

This is problematic as phishing actors and scammers can simply include some HTML and CSS code in their outgoing emails to tamper with the wording of the warning message or to make it disappear ...

The malicious code in question? An infinite loop that popped up an alert message, immediately showing a new message each time you click OK. Those curious to see the code can see it in action here ...