CSS attacks on major webmail services can steal credentials, hijack sessions and manipulate AI tools connected to users’ inboxes.

PortSwigger researcher Gareth Heyes demonstrated something that should make every webmail team a little nervous: plain CSS, the styling language that’s supposed to just make text look nice, can be weaponized to steal passwords, hijack sessions, and manipulate AI tools reading your inbox. The research covers real attack chains against Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail.

The core idea is that email clients let HTML and CSS through with the assumption that styling can’t reach outside the message it’s attached to. Heyes found ways to break that assumption using two basic approaches: abusing CSS features webmail already permits, or exploiting a gap between what a content sanitizer thinks it approved and what the browser actually renders. Either route can let content inside an untrusted email interact with the trusted interface surrounding it.

“It’s quite common for webmail clients to render untrusted CSS in a trusted UI. They attempt to make this safe using CSS sanitization.” Heyes explains. “I looked at the various “allow listed” CSS properties and HTML. With the goal of abusing them to spoof UI actions, control browsers, take over accounts or steal tokens. I targeted Fastmail, OpenAI’s Atlas, Firefox, AOL Mail, Yahoo Mail and Outlook.”

The Outlook chain is the most alarming one to picture in action. Allowed label elements can trigger controls that live outside the email itself, and Outlook’s own JavaScript can turn sanitized custom attributes into new page elements carrying CSS that bypasses the sanitizer’s rules entirely. Heyes used this to disguise a dropdown menu as a password field, and because Firefox resets its roughly one-second selection timer whenever that dropdown moves offscreen, the attack captures whatever the victim types in something close to real time.

“A CSS gadget occurs when some existing JavaScript appends an element to the DOM with a CSS property or value outside the webmail CSS sanitizer allow list. We can use this to break out of trust boundaries.” continues the report.

“This is a real CSS gadget that I found on Outlook. Here Outlook “allow lists” custom data attributes. One of the libraries they use appends to the DOM with an element and CSS property value outside their allow list. In this case position:fixed which allows you to position an element anywhere on the page. Which breaks the trust boundaries of an email message. We can then use this gadget to break out of the message window and deface Outlook.”

Yahoo Mail and AOL Mail opened a different door, one involving something as mundane as copy and paste. In Firefox, HTML pasted into a draft can briefly keep its active styling before sanitization strips it out, and Heyes used that gap to leak a 12-character login token during a Medium sign-in flow, enough for an attacker’s server to reconstruct the token and log in as the victim.

“They have a login via email feature that produces a 12 character hex token. If you can obtain this token then you can login as the user. An attacker can just initiate this process with the victim’s email then create some CSS to copy to the clipboard, the victim then only needs to paste into a draft and then their token is stolen.” the researcher explains.

There’s also a clever workaround for cases where Content Security Policy blocks external resource requests entirely. Given the ability to inject styles and a numeric token displayed as plain text in an email, CSS alone can determine which digits appear and how often, then arrange links so a single click reveals that information to an attacker’s server. No JavaScript required, just careful use of selectors and visibility rules.

The AI-connected piece of this research is where things get genuinely unsettling. Gmail’s image-set() fallback could trigger an external request despite sanitization, and Heyes chained that into an indirect prompt-injection email processed by Anthropic’s Claude Cowork through a connected Gmail integration. The injected instructions caused it to retrieve the token and place it in an HTML draft; viewing the draft leaked it, exactly the kind of AI-agent trap that turns a normal “summarize my inbox” request into unintended data exposure. A separate demonstration against OpenAI’s Atlas browser used hidden CSS pseudo-elements to show a human harmless text while an AI model read a completely different, hidden instruction underneath.

Not every provider is equally exposed right now. Fastmail patched two CSS mutation bugs Heyes reported, and a Proton Mail proxy bypass stopped working when he retested it before publication. Outlook’s label-jacking trick and Gmail’s image-set() bypass, on the other hand, both still worked as of August 6, and the paper doesn’t confirm whether the full Outlook password-capture chain has been fixed at all.

Heyes and PortSwigger published proof-of-concept code publicly alongside the research, and their guidance for webmail providers is fairly specific: isolate HTML email inside sandboxed iframes, restrict CSS to strict character allow-lists, check for dangerous CSS gadgets before permitting custom attributes, and block image requests to anything outside an approved domain list. None of that is exotic advice, but it does mean rethinking how much trust gets extended to something as apparently harmless as a stylesheet.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CSS Attacks)

After attacks hit 30+ Minnesota water systems, CISA urged utilities to remove internet-exposed PLCs and strengthen OT security.

Between Sunday and Monday, July 26 and 27, a coordinated cyberattack hit operational technology (OT) systems at more than 30 community water utilities across the state, according to Minnesota IT Services (MNIT).

“A coordinated cyberattack targeted operational technology at more than 30 Minnesota community water systems on July 26 and 27. Minnesota IT Services (MNIT) immediately activated the state’s cybersecurity incident response capabilities.” reads the statement published by MNIT. “MNIT continues to collaborate with federal, state, local, Tribal, and private-sector partners to investigate the attack, support affected communities, and strengthen the security of Minnesota’s critical infrastructure.”

The agency activated its statewide incident response the moment it learned of the attack, and it’s still active as of this week.

Four cities went public with details: Braham, Maple Plain, Plymouth, and South St. Paul. Braham took the hardest hit of the group; the town of about 1,700 people had its water plant knocked offline entirely after attackers disabled the computerized controls running its well and treatment systems.

State and federal investigators are working to determine attribution, but the timing is hard to ignore: the attacks came four days after CISA updated its advisory on Iranian-affiliated actors targeting programmable logic controllers across US critical infrastructure. No formal attribution has been made, but Tenable researchers assess the operational pattern is consistent with CyberAv3ngers, an Iran-linked group formally tied to the IRGC.

“Federal and state officials have not publicly attributed the Minnesota attacks to any specific actor. However, the operational pattern is consistent with the CyberAv3ngers threat ecosystem, a state-directed group the U.S. government has formally attributed to Iran’s Islamic Revolutionary Guard Corps Cyber-Electronic Command.” reported Tenable.

CISA now warns of a surge in attacks targeting internet-exposed PLCs at water utilities. Attackers have changed passwords and IP addresses to lock out operators, causing boil water notices and forcing some facilities to switch to manual operations. The US agency urges organizations to remove publicly accessible PLCs and other OT systems from the internet immediately.

“CISA is currently observing a significant increase in cyber threat actors targeting programmable logic controllers (PLCs) in the Water and Wastewater Systems (WWS) Sector. CISA urges critical infrastructure owners, operators, and integrators to remove publicly exposed PLCs and other operational technology (OT) from the internet as soon as possible.” reads CISA’s alert. “Threat actors targeting exposed PLCs have modified passwords to lock out operators and disconnected the PLCs by changing their IP addresses. This activity has resulted in boil water notices and sustained manual operations.”

The FBI confirmed that utility companies in at least seven states have reported PLC-related incidents. The attacks aren’t sophisticated in the traditional sense, after remotely accessing internet-facing devices, the actors changed IP addresses and passwords, resulting in loss of monitoring and control functionality. That’s it. Default or weak credentials on internet-exposed hardware, and suddenly operators are locked out of their own systems.

CVE-2021-22681 is a critical Rockwell Automation vulnerability (CVSS 9.8) that remained unexploited for years because industrial control systems are difficult to patch without disrupting essential services. Since March 2026, however, Iranian-affiliated threat actors have actively exploited the flaw, prompting CISA to add it to its Known Exploited Vulnerabilities catalog. Rockwell has confirmed that no security patch is available, making network isolation and other compensating controls essential.

That last sentence is worth sitting with. A CVSS 9.8 vulnerability in controllers that run public water infrastructure, no patch, actively exploited. The compensating control is network isolation, which is exactly what CISA is now urgently requesting.

“These threat actors are targeting water entities of all sizes. Even water organizations with mature cybersecurity processes should validate their external connections, as this targeting activity includes cellular modems installed by operators, vendors, or system integrators that may not be documented or included in routine attack surface scans.” continues the alert. “OT assets exposed to the internet have an increased risk of defacement, configuration changes, operational disruptions, and, in severe cases, physical damage.”

A July 2026 update to CISA’s advisory found that attacks exploiting internet-exposed PLCs have expanded beyond Rockwell Automation to include Schneider Electric and Siemens devices. The advisory also documents attackers stealing PLC project files for the first time and adds new guidance to detect tampering with reusable code modules embedded in industrial control programs.

Exfiltrating project files means the attacker is taking the engineering logic of the plant, the actual programmed behavior of the industrial process, and studying it offline. That’s reconnaissance for a more targeted future attack, not just disruption for its own sake.

The Minnesota attacks resulted in boil water notices and sustained manual operations at affected utilities. Drinking water remained safe in most cases, and contingency procedures held. But the affected cities include Maple Plain, Braham, South St. Paul, and Plymouthm not isolated rural facilities, but communities of real scale. CyberAv3ngers is known for targeting small water and municipal facilities, which experts believe are among the lowest-hanging fruit in US critical infrastructure. Many small and rural facilities lack dedicated cybersecurity resources. That’s the point. These attacks aren’t about technical sophistication. They’re about finding the organizations with the least capacity to defend themselves and demonstrating that the capability to disrupt public services exists and can be exercised.

CISA’s alert specifically notes that even mature organizations should validate their external connections, because the targeting includes cellular modems installed by operators, vendors, or system integrators that may not appear in routine network scans. A modem installed by a contractor for remote access and never documented in the asset inventory is still an attack surface. The practical checklist is short: get PLCs off the internet, segment OT networks from IT networks, change default credentials, and audit every remote access path, including the ones you didn’t authorize.

“CISA recommends organizations implement the following mitigations:

• Disconnect the PLC from the internet. Remote access for operational purposes should go through a VPN or gateway device, not directly to the PLC.
• Enable password protection and change default passwords.
• Allowlist IPs to only allow remote access from known engineering laptops or other critical OT assets.

After disconnecting PLCs from the internet, operators should ensure they have a known clean backup of the PLC image in case they are locked out by a modified password.” concludes CISA. Note: Owners, operators, and integrators of Rockwell Automation MicroLogix 1400 PLCs should see Rockwell Automation’s IMPORTANT NOTICE: Restoring Access to a MicroLogix 1400 Controller When the Password Is Unknown for guidance addressing this activity.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)