Outlook CSS Attack Fakes a Microsoft Sign In to Steal Your Password

CSS in an email put a fake Microsoft sign-in over a live Outlook inbox and read the password letter by letter. Opening the message is enough. Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail and AOL Mail gave way. 🧐 Microsoft and Google still have not fixed their part. Webmail has a problem it has never fully solved. Someone sends you HTML, and that HTML has to be displayed inside a page that…