High Severity

Link: URL fragmented by hidden spans

Labels

Credential Phishing
Evasion
Social engineering
HTML analysis
Content analysis
URL analysis

Description

Detects messages containing HTML links that are broken up with inline <span> elements styled with display:none, injecting random alphanumeric strings inside the URL to defeat text-based scanning while rendering strings that looks like a link to the recipient. Observed lures impersonate HR or payroll communications, such as fake 401K enrollment notices and PTO balance alerts, sent from unrelated or spoofed domains to drive clicks on the obfuscated link.

References

No references.

Sublime Security
Created Aug 13th, 2026 • Last updated Aug 13th, 2026
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and strings.icontains(body.html.raw, 'https:/<span')
and regex.icontains(body.html.raw,
                    'https:/<span[^>]{0,300}display:\s*none[^>]{0,300}>[A-Z0-9]{6,}\s*</span>/'
)
MQL Rule Console
•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started
Deploy and integrate a free Sublime instance in minutes.
Get Started