Kobold letters

Kobold letters

Konstantin Weddige explains a sophisticated HTML email phishing vector he calls Kobold emails.

When you forward a message, most HTML email clients will indent the forward by nesting it inside another element.

This means CSS rules within the email can be used to cause an element that was invisible in the original email to become visible when it is forwarded - allowing tricks like a forwarded innocuous email from your boss adding instructions for wiring money from the …

become css element email emails html inside phishing rules security vector will