Webmail CSS Attacks Expose a New Risk for AI-Powered Email Tools

CSS attacks on major webmail services can steal credentials, hijack sessions and manipulate AI tools connected to users’ inboxes. PortSwigger researcher Gareth Heyes demonstrated something that should make every webmail team a little nervous: plain CSS, the styling language that’s supposed to just make text look nice, can be weaponized to steal passwords, hijack sessions, and […] This development is consistent with broader industry trends, where threat actors increasingly reuse proven techniques and commodity tooling rather than investing in novel malware. Beyond patching, organizations should inventory exposed services, disable unused functionality, and require multi-factor authentication wherever it can be deployed.