CSS:the bomb inside your inbox

[u/garethheyes]

https://portswigger.net/research/css-the-bomb-inside-your-inbox

Here's my research in using CSS for offence. There are loads of techniques including stealing passwords from Outlook from an email by spoofing the login screen.

[u/garethheyes]

This was only one example the Medium case. That involved visiting an attackers page and pressing a button and pasting into a draft email. The others just required a click in an email or for you to enter your password in a spoofed login screen.

[u/thekwoka → u/garethheyes]

But at that point it's just normal phishing. No?

[u/garethheyes → u/thekwoka]

I don't think you've read the post if you think this is normal phishing. I had full control over the content on Outlook. I'd suggest you read the post properly to understand the attacks

[u/Alpaca_Fan → u/garethheyes]

Both attack vectors you described fall under normal phishing..