Microsoft 365 anti-phishing feature can be bypassed with CSS

Researchers from Certitude demonstrated a technique that uses embedded CSS in HTML emails to hide Outlook's 'First Contact Safety Tip' and to spoof security icons, making phishing messages appear more trustworthy; the issue was reported to Microsoft, which acknowledged the finding but decided it does not currently meet the threshold for immediate servicing, and no active exploitation has been observed.