Link: URL fragmented by hidden spans

calendar Aug 13, 2026  ·
Share on: linkedin copy

Detects messages containing HTML links that are broken up with inline elements styled with display:none, injecting random alphanumeric strings inside the URL to defeat text-based scanning while rendering strings that looks like a link to the recipient. Observed lures impersonate HR or payroll communications, such as fake 401K enrollment notices and PTO balance alerts, sent from unrelated or spoofed domains to drive clicks on the obfuscated link.

Sublime rule (View on GitHub)

 1name: "Link: URL fragmented by hidden spans"
 2description: "Detects messages containing HTML links that are broken up with inline <span> elements styled with display:none, injecting random alphanumeric strings inside the URL to defeat text-based scanning while rendering strings that looks like a link to the recipient. Observed lures impersonate HR or payroll communications, such as fake 401K enrollment notices and PTO balance alerts, sent from unrelated or spoofed domains to drive clicks on the obfuscated link."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and strings.icontains(body.html.raw, 'https:/<span')
 8  and regex.icontains(body.html.raw,
 9                      'https:/<span[^>]{0,300}display:\s*none[^>]{0,300}>[A-Z0-9]{6,}\s*</span>/'
10  )  
11attack_types:
12  - "Credential Phishing"
13tactics_and_techniques:
14  - "Evasion"
15  - "Social engineering"
16detection_methods:
17  - "HTML analysis"
18  - "Content analysis"
19  - "URL analysis"
20id: "9c7f6db1-2e4e-50db-ab74-eaa29822189e"
to-top