Phishing remains one of the most effective strategies for attackers to breach an organization’s defenses. There are numerous tactics and techniques that can be used to deliver a phishing email.
To combat this, email clients like Outlook and Gmail have implemented security features designed to alert users when they receive emails from unfamiliar sources. One such feature in Outlook is the “First Contact Safety Tip,” which notifies users when they receive an email from an unknown sender.
This notification displays the message: “You don’t often get email from xyz@example.com. Learn why this is important.” This prompt helps users recognize and avoid potential phishing attempts. The “First Contact Safety Tip” is just one of the many anti-phishing tools available within Exchange Online and Microsoft Defender for Office 365 users.
However, researchers have identified a method to bypass this warning, potentially making phishing emails appear more legitimate and increasing the likelihood that a user will interact with them.
The “First Contact Safety Tip” is inserted at the top of an HTML email by Outlook. By manipulating CSS styles within the email, attackers can alter the display of this warning to the user.
For example, in one proof of concept, researchers successfully hid the “First Contact Safety Tip” by embedding specific CSS tags that rendered the text invisible to the recipient. The HTML email included styles that changed the background and font colors to white, effectively concealing the alert.
<head>
<style>
a {
display: none;
}
td div {
color: white;
font-size: 0px;
}
table tbody tr td {
background-color: white !important;
color: white !important;
}
</style>
</head>Additionally, researchers were able to spoof the icons that Microsoft Outlook attaches to encrypted or signed emails, further enhancing the deception. The following code demonstrates how attackers can spoof the appearance of a signed email:
#mainTable {
width: 100%;
z-index: 1;
margin-bottom: 1em;
}
#signedBy {
font-size: 0.9em;
}
.badge {
width: 2.8em;
text-align: right;
}In this example, the phrase “Signed By nimmerrichtermarc@gmail.com” uses a Unicode character (U+2024) instead of a standard period (.), causing Outlook to interpret it as an email address and generate a mailto link. Although this approach can deceive some users, those who are more attentive might notice slight formatting inconsistencies, though many may not, leading them to fall victim to phishing attacks.
Microsoft has acknowledged the issue but has yet to address it. In a response dated February 14, 2024, Microsoft stated, “We determined your finding is valid but does not meet our bar for immediate servicing, considering this is mainly applicable for phishing attacks. However, we have still marked your finding for future review as an opportunity to improve our products.”
It’s crucial for users to remain vigilant against phishing emails, paying close attention to any unusual formatting or suspicious links in emails from unknown senders. Avoid clicking on unverified links or downloading attachments from unfamiliar sources.
