Abusing with style: Leveraging cascading style sheets for evasion and tracking

Cisco Talos reports on recent abuses of CSS in phishing and spam emails to evade detection and track recipients, including hidden text salting (using properties like text-indent, opacity, clip/clip-path), HTML smuggling, and CSS-based tracking and fingerprinting via media queries, print/color-scheme/client detection, and font-based OS inference, observed from late 2024 to February 2025; the post recommends advanced filtering and email privacy proxies to mitigate both security evasion and privacy risks.