Evasion: Hidden text using CSS-obscured HTML option labels

calendar Sep 1, 2026  ·
Share on: linkedin copy

Detects inbound messages containing HTML elements that are visually hidden through CSS techniques such as extreme negative z-index values or zero-sized dimensions, combined with

Sublime rule (View on GitHub)

 1name: "Evasion: Hidden text using CSS-obscured HTML option labels"
 2description: "Detects inbound messages containing HTML elements that are visually hidden through CSS techniques such as extreme negative z-index values or zero-sized dimensions, combined with <option> tags containing label attributes. This pattern is indicative of hidden text salting, where invisible or off-screen content is injected into the HTML body to manipulate content analysis engines and evade detection."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(html.xpath(body.html, "//option[.//table or .//article]").nodes,
 8          any(ml.nlu_classifier(.inner_text).intents,
 9              .name == 'cred_theft' and .confidence != 'low'
10          )
11  )  
12attack_types:
13  - "Credential Phishing"
14tactics_and_techniques:
15  - "Evasion"
16  - "Social engineering"
17  - "Impersonation: Brand"
18detection_methods:
19  - "HTML analysis"
20  - "URL analysis"
21  - "Content analysis"
22id: "9fa3b006-4ee3-5d7c-af60-af872f603bcd"
to-top