Body: CSS Hidden text via clip-path

calendar Aug 5, 2026  ·
Share on: linkedin copy

Detects inbound messages containing a div styled with 'clip-path: inset(100%)', a CSS technique used to visually hide substantial blocks of text (over 150 characters) from the recipient while keeping it present in the underlying HTML. This method is commonly used to evade content-based detection engines by hiding filler or unrelated text within the message body.

Sublime rule (View on GitHub)

 1name: "Body: CSS Hidden text via clip-path"
 2description: "Detects inbound messages containing a div styled with 'clip-path: inset(100%)', a CSS technique used to visually hide substantial blocks of text (over 150 characters) from the recipient while keeping it present in the underlying HTML. This method is commonly used to evade content-based detection engines by hiding filler or unrelated text within the message body."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(html.xpath(body.html, '//div[contains(@style,"clip-path")]').nodes,
 8          regex.icontains(.raw, 'clip-path:\s*inset\(\s*100%')
 9          and length(.inner_text) > 150
10  )  
11attack_types:
12  - "Spam"
13  - "Credential Phishing"
14tactics_and_techniques:
15  - "Evasion"
16detection_methods:
17  - "HTML analysis"
18  - "Content analysis"
19id: "ca09550e-7f33-535c-a178-3455faa5143b"
to-top