Small CSS tweaks can help nasty emails slip through Outlook's anti-phishing net

Researchers demonstrated a simple CSS-based bypass of Outlook's First Contact Safety Tip by crafting HTML emails that change the banner's background and font to white, rendering the warning invisible to recipients; the technique can also be used to spoof signed/encrypted notes. The researchers reported the issue to Microsoft, which validated the finding but determined it does not meet the bar for immediate servicing.