Medium Severity

Body: CSS Hidden text via clip-path

Labels

Spam
Credential Phishing
Evasion
HTML analysis
Content analysis

Description

Detects inbound messages containing a div styled with 'clip-path: inset(100%)', a CSS technique used to visually hide substantial blocks of text (over 150 characters) from the recipient while keeping it present in the underlying HTML. This method is commonly used to evade content-based detection engines by hiding filler or unrelated text within the message body.

References

No references.

Sublime Security
Created Aug 5th, 2026 • Last updated Aug 5th, 2026
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and any(html.xpath(body.html, '//div[contains(@style,"clip-path")]').nodes,
        regex.icontains(.raw, 'clip-path:\s*inset\(\s*100%')
        and length(.inner_text) > 150
)
MQL Rule Console
•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started
Deploy and integrate a free Sublime instance in minutes.
Get Started