New HTML-Based Tactic Lets Hackers Lure Outlook Users into Clicking Malicious Links

A sophisticated phishing email campaign is leveraging a nuanced HTML technique to selectively display benign or malicious links based on the recipient’s email client, raising the bar for detection and response efforts within both corporate and personal environments.

The phishing messages, which at first glance mimic standard bank notifications asking users to update account information, employ a deceptive twist.

Upon inspection, the embedded clickable area initially appears to lead to a legitimate banking website.

This subtlety can easily lull even cautious users and automated security scanners into a false sense of security.

Conditional Rendering Ramps Up Phishing Sophistication

However, a deeper look at the underlying HTML code reveals the crux of the attack: conditional comments.

Using legacy Microsoft Office conditional statements such as <!--[if mso]> (standing for “Microsoft Office”) and <!-- [if !mso]> (meaning “not Microsoft Office”), attackers are able to control which content is displayed depending on whether the email is opened in Microsoft Outlook or another client, such as a web browser or mobile app.

When viewed in Outlook an email client still widely used across corporate environments the link is rendered as a harmless, legitimate URL.

In all other clients, the code substitutes this with a malicious link designed to steal banking credentials or other sensitive information. The conditional sections look like this in the email’s code:

xml<!--[if mso]>
    <a href=[benign link]>Update Now</a>
<![endif]--><!--[if !mso]><!-->
    <a href=[malicious link]>Update Now</a>
<!--<![endif]-->

According to the Report, this dual rendering technique exploits the fact that many organizations rely on Outlook for desktop, where advanced security gateways and web filters are in place, often reducing the perceived risk of phishing.

Attackers Exploit Outlook

Meanwhile, private users who are more likely to access email through webmail or mobile applications are exposed to the malicious payload.

This approach allows attackers to bypass security controls that scan emails as they arrive on corporate systems, reducing their chance of detection and increasing the odds that the real target will interact with the harmful content on a less-protected device.

Though this technique has been documented as far back as 2019, its use in the wild remains rare, likely due to the specialized knowledge required to craft such emails and the need to target specific environments.

Its effectiveness, however, is undeniable especially in attacks seeking to evade both user suspicion and automated defenses.

In the context of this campaign, the phishing actors likely intended to avoid scrutiny within company networks, where an email from a bank to a business address would raise immediate suspicions.

By reserving the malicious payload for those opening the email outside of Outlook, they increase their chances of catching individuals off-guard, especially outside the protective perimeter of enterprise security.

This tactic serves as a timely reminder for both individuals and organizations to be vigilant about sophisticated email threats that go beyond obvious red flags.

Security awareness training should emphasize checking email content across devices, and IT administrators are encouraged to review email filtering rules to detect such conditional HTML structures. As phishing evolves, so too must the techniques for defending against it.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Update