Outlook Users Targeted by New HTML-Based Phishing Scheme

A recent phishing campaign has revealed a sophisticated technique that exploits Microsoft Outlook’s unique handling of HTML emails to conceal malicious links from corporate users.

The attack, initially appearing as a standard phishing attempt impersonating a Czech bank, leverages conditional HTML comments to display different content depending on the email client used to open the message.

This method allows attackers to show a legitimate bank URL to Outlook users while redirecting everyone else to a credential-harvesting site.

How Conditional HTML Comments Work

According to the report, the core of this evasion technique lies in Microsoft’s proprietary conditional comments, known as “MSO conditional tags.”

These tags allow developers to target specific versions of Outlook by wrapping HTML code in special comments that only Outlook recognizes.

The syntax looks like this:

xml<!--[if mso]>
    <a href="https://benign-bank.com">Update Your Info</a>
<![endif]-->
<!--[if !mso]><!-->
    <a href="https://malicious-phish.com">Update Your Info</a>
<!--<![endif]-->

• <!--[if mso]> ... <![endif]-->: Content inside this block is rendered only by Outlook.
• <!--[if !mso]><!--> ... <!--<![endif]-->: Content inside this block is rendered by all clients except Outlook.

In this phishing campaign, the attackers use these conditional statements to ensure that security teams—who often use Outlook in corporate environments—see only the safe, legitimate link.

However, recipients using other email clients (like Gmail or Thunderbird) are shown the malicious link, increasing the chances of a successful credential theft.

How Different Email Clients Render the Phishing Email

Email Client	Displayed Link	Rendered Code Block
Outlook (Desktop)	https://benign-bank.com	<!--[if mso]>
Gmail/Thunderbird	https://malicious-phish.com	<!--[if !mso]><!-->

Security Implications and Mitigation Strategies

This technique is particularly dangerous because it can bypass many traditional email security gateways.

These gateways often ignore content inside HTML comments, assuming it is non-executable, but Outlook’s conditional comments are an exception.

As a result, the malicious payload can slip past security filters and remain hidden from initial analysis.

Mitigation Recommendations:

• Deploy advanced Email Security Gateways capable of parsing and neutralizing MSO conditional comments.
• Train users to be cautious of emails urging immediate action, especially those requesting sensitive information, even if the link appears legitimate in Outlook.
• Use sandboxing tools that open suspicious emails in multiple clients to reveal hidden malicious content.

Sample Detection Rule (Pseudo-code):

pythonif "<!--[if mso]>" in email_html and "<!--[if !mso]><!-->" in email_html:
    flag_as_suspicious(email)

While the abuse of Outlook’s conditional comments for phishing is not new—having been documented as early as 2019—its occurrence in real-world attacks remains rare and underreported.

This method underscores the need for security teams to look beyond what is visible in their preferred email client and to understand the nuances of HTML rendering across platforms.

As attackers continue to innovate, awareness and technical vigilance remain the best defenses against evolving phishing threats.

By staying informed and updating defenses, organizations can better protect themselves against these nuanced and technically advanced phishing campaigns.

To Upgrade Your Cybersecurity Skills, Take Diamond Membership With 150+ Practical Cybersecurity Courses Online – Enroll Here