KOBOLD LETTERS

Summary from the TLDR InfoSec newsletter

This post from Lutra Security demonstrates an email phishing technique called Kobold Letters. In this attack, an attacker makes use of CSS selectors to make an email appear benign until it is forwarded, at which point the phishing email appears. This occurs because the HTML content is moved when the email is forwarded. Examples are provided for various email clients.