Body: CSS clamp() font obfuscation

calendar Sep 1, 2026  ·
Share on: linkedin copy

Detects inbound messages where the HTML body (including HTML content within .eml attachments) uses CSS clamp() with a font-size or line-height minimum bound of zero or a negative value. This technique renders text invisible or unreadable to recipients while remaining present in the underlying markup, a method commonly used to hide malicious content or evade text-based detection engines.

Sublime rule (View on GitHub)

 1name: "Body: CSS clamp() font obfuscation"
 2description: "Detects inbound messages where the HTML body (including HTML content within .eml attachments) uses CSS clamp() with a font-size or line-height minimum bound of zero or a negative value. This technique renders text invisible or unreadable to recipients while remaining present in the underlying markup, a method commonly used to hide malicious content or evade text-based detection engines."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    (
 9      regex.icontains(body.html.raw,
10                      '(?:font-size|line-height):\s*clamp\s*\(\s*(?:-\d+|0)(?:px|em|rem|pt)?,'
11      )
12    )
13    or any(attachments,
14           (.content_type == "message/rfc822" or .file_extension =~ "eml")
15           and regex.icontains(file.parse_eml(.).body.html.raw,
16                               '(?:font-size|line-height):\s*clamp\s*\(\s*(?:-\d+|0)(?:px|em|rem|pt)?,'
17           )
18    )
19  )  
20attack_types:
21  - "Credential Phishing"
22tactics_and_techniques:
23  - "Evasion"
24  - "Social engineering"
25detection_methods:
26  - "HTML analysis"
27  - "URL analysis"
28  - "Content analysis"
29id: "0eaf1193-22e2-5cc2-845c-4f8f26b48ab2"
to-top