Monday, February 10, 2025
HomeCyber Security NewsMicrosoft 365 Vulnerability Let Hackers Bypass Anti-phishing Feature

Microsoft 365 Vulnerability Let Hackers Bypass Anti-phishing Feature

Published on

SIEM as a Service

Follow Us on Google News

A vulnerability in Microsoft 365 (formerly Office 365) has been found that allows malicious actors to bypass anti-phishing measures.

One of the anti-phishing features available in Exchange Online Protection (EOP) and Microsoft Defender to Office 365 enterprises is the ‘First Contact Safety Tip.’

In the first contact safety tip, users are cautioned when they get an email from a sender that they don’t typically communicate with.

Since the First Contact Safety Tip is appended to the HTML email body, you can use Cascading Style Sheet (CSS) style tags to change how the tip is displayed.

Are you from SOC and DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Free Access

As a result, experts have developed an approach in this scenario that “hides” the First Contact Safety Tip from the user.

Keeping The Safety Tip Hidden

when users receive an email from a sender with whom they don’t normally interact. Outlook displays an alert stating, “You don’t often get emails from xyz@example.com.”

Researchers demonstrate an HTML email that “hides” the user’s access to the First Contact Safety Tip. 

Even though the inline CSS in the elements or the rendering engine Outlook uses don’t seem to support applying some more common CSS rules like display: none, height: 0px, and opacity: 0 to the table itself, it is still possible to change the background and font colors to white to make the alert practically invisible.

“It is possible to change the background and font colors to white so that the alert is effectively invisible when rendered to the end user viewing the email”, Certitude researchers shared with Cyber Security News.

Hiding the Safety Tip

The alert will no longer appear in the email body when this HTML code is used in an email!

The alert is hidden in the Email body 

Beyond that, experts spoof the icons that Microsoft Outlook includes to encrypt and/or sign emails.

After receiving reports about these issues, Microsoft decided not to fix this behavior.

Microsoft MSRC stated, “We determined your finding is valid but does not meet our bar for immediate servicing, considering this is mainly applicable to phishing attacks.

However, we have still marked your finding for future review as an opportunity to improve our products”.

How to Build a Security Framework With Limited Resources IT Security Team (PDF) - Free Guide

Aman Mishra
Aman Mishra
Aman Mishra is a Security and privacy Reporter covering various data breach, cyber crime, malware, & vulnerability.

Latest articles

SHA256 Hash Calculation from Data Chunks

The SHA256 algorithm, a cryptographic hash function, is widely used for securing data integrity...

New Report of of 1M+ Malware Samples Show Application Layer Abused for Stealthy C2

A recent analysis of over one million malware samples by Picus Security has revealed...

Seven-Year-Old Linux Kernel Bug Opens Door to Remote Code Execution

Researchers have uncovered a critical vulnerability in the Linux kernel, dating back seven years,...

Ransomware Payments Plunge 35% as More Victims Refuse to Pay

In a significant shift within the ransomware landscape, global ransom payments plummeted by 35%...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

SHA256 Hash Calculation from Data Chunks

The SHA256 algorithm, a cryptographic hash function, is widely used for securing data integrity...

New Report of of 1M+ Malware Samples Show Application Layer Abused for Stealthy C2

A recent analysis of over one million malware samples by Picus Security has revealed...

Seven-Year-Old Linux Kernel Bug Opens Door to Remote Code Execution

Researchers have uncovered a critical vulnerability in the Linux kernel, dating back seven years,...